PT-2022-13743 · Medialize · Uri.Js

Zeyu2001 · Published 2022-04-05 · Updated 2023-07-24 · CVE-2022-1243

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions medialize/uri.js versions prior to 1.19.11

Description The issue is related to CRHTLF, which can lead to invalid protocol extraction, potentially resulting in XSS. Specifically, characters such as r, , and t in user-input URLs can cause incorrect protocol extraction when using the npm package urijs. This can be exploited to bypass security measures intended to prevent malicious javascript links from being passed into HTML or JavaScript. For example, an attacker could use a URL like "jar vascript:alert(1)" to execute malicious JavaScript code.

Recommendations For versions prior to 1.19.11, update to version 1.19.11 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user-input URLs to prevent malicious characters from being injected. Additionally, restrict the use of the urijs module to trusted input only, until the update can be applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-1243

GHSA-3VJF-82FF-P4R3

Affected Products

Uri.Js

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1243.json · Exploit
• 🔥 https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7 · Exploit
• https://github.com/medialize/uri.js/commit/b0c9796aa1a95a85f40924fb18b1e5da3dc8ffae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1243 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1243 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3vjf-82ff-p4r3 · Vendor Advisory
• https://github.com/medialize/uri.js · Note
• https://t.me/cibsecurity/40167 · Telegram Post