PT-2022-16831 · Uri.Js · Uri.Js

P0Cas · Published 2022-03-03 · Updated 2023-07-03 · CVE-2022-24723

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions URI.js versions prior to 1.19.9

Description The issue arises from whitespace characters not being removed from the beginning of the protocol, resulting in improper URL parsing. This can cause protocol validation mechanisms to fail. The problem has been patched in version 1.19.9. As a workaround, removing leading whitespace from values before passing them to URI.parse can mitigate the issue.

Recommendations For versions prior to 1.19.9, update to version 1.19.9 to resolve the issue. As a temporary workaround, consider removing leading whitespace from values before passing them to URI.parse, for example, by using a function to remove whitespace from the URL.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-24723

GHSA-GMV4-R438-P67F

Affected Products

Uri.Js

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24723.json · Exploit
• 🔥 https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5 · Exploit
• https://github.com/medialize/uri.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24723 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-24723 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24723 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24723 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gmv4-r438-p67f · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24723 · Vendor Advisory
• https://github.com/medialize/URI.js · Note
• https://github.com/medialize/URI.js/releases/tag/v1.19.9 · Note
• https://github.com/medialize/URI.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316 · Note
• https://github.com/medialize/URI.js/security/advisories/GHSA-gmv4-r438-p67f · Note
• https://t.me/cvenotify/53591 · Telegram Post
• https://t.me/cvenotify/28008 · Telegram Post