PT-2022-13733 · Medialize · Uri.Js

Zeyu2001 · Published 2022-04-04 · Updated 2022-11-29 · CVE-2022-1233

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions medialize/uri.js versions prior to 1.19.11

Description The issue arises when parsing a URL without a scheme and with excessive slashes, like ///www.example.com. Unlike browsers, which parse such URLs as http://www.example.com, the affected software parses the hostname as null and the path as /www.example.com. This discrepancy can lead to unexpected behavior, such as redirects to http://www.example.com.

Recommendations For versions prior to 1.19.11, update to version 1.19.11 or later to resolve the issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

CWE-115

Related Identifiers

CVE-2022-1233

GHSA-G694-M8VQ-GV9H

Affected Products

Uri.Js

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1233.json · Exploit
• 🔥 https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371c · Exploit
• https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277 · Patch
• https://osv.dev/vulnerability/GHSA-g694-m8vq-gv9h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1233 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1233 · Vendor Advisory
• https://github.com/medialize/uri.js · Note
• https://t.me/cibsecurity/40122 · Telegram Post