PT-2022-13363 · Parse-Url+2 · Url-Parse+2

Published 2022-02-21 · Updated 2023-03-27 · CVE-2022-0691

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions url-parse versions prior to 1.5.9

Description The issue arises from leading control characters in a URL not being stripped when passed into url-parse, potentially causing input URLs to be mistakenly interpreted as relative URLs without a hostname and protocol. This discrepancy can lead to incorrect security decisions when comparing the parsed URL with the WHATWG URL parser, which trims control characters and treats the URL as absolute. Furthermore, this can lead to a cross-site scripting (XSS) vulnerability if url-parse is used to check for the javascript: protocol in URLs.

Recommendations For versions prior to 1.5.9, update to version 1.5.9 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing input URLs to prevent leading control characters from being passed into url-parse. Restrict the use of url-parse in security decisions involving the hostname or protocol until the update is applied. Avoid using url-parse to check for the javascript: protocol in URLs without additional validation until the issue is resolved.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-0691

DLA-3336-1

GHSA-JF5R-8HM2-F872

USN-5973-1

Affected Products

Linuxmint

Ubuntu

Url-Parse

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0691.json · Exploit
• 🔥 https://huntr.dev/bounties/57124ed5-4b68-4934-8325-2c546257f2e4 · Exploit
• https://github.com/unshiftio/url-parse/commit/0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63 · Patch
• https://ubuntu.com/security/CVE-2021-27515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0691 · Security Note
• https://ubuntu.com/security/CVE-2022-0686 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0691 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-0691 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0691 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0691 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0691 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-3774 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0512 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0691 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5973-1 · Vendor Advisory