org.webjars.npm:parse-url@5.0.1 vulnerabilities

org.webjars.npm:parse-url is an An advanced url parser supporting git urls too.

Affected versions of this package are vulnerable to Improper Input Validation due to incorrect parsing of URLs. This allows the attacker to craft a malformed URL which can lead to a phishing attack.

const parseUrl = require("parse-url");
const Url = require("url");

const express = require('express');
const app = express();

var url = "https://www.google.com:x@fakesite.com:x";
parsed = parseUrl(url);
console.log("[*]`parse-url` output: ")
console.log(parsed);

parsed2 = Url.parse(url);
console.log("[*]`url` output: ")
console.log(parsed2)

app.get('/', (req, res) => {
    if (parsed.host == "www.google.com") {
        res.send("<a href=\'" + parsed2.href + "\'>CLICK ME!</a>")
    }
})

app.listen(8888,"0.0.0.0");

Upgrade org.webjars.npm:parse-url to version 8.1.0 or higher.

org.webjars.npm:parse-url is an An advanced url parser supporting git urls too.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to improper detection of protocol, resource, and pathname fields. Exploiting this vulnerability results in bypassing protocol verification.

Upgrade org.webjars.npm:parse-url to version 8.1.0 or higher.

org.webjars.npm:parse-url is an An advanced url parser supporting git urls too.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of special ASCII characters that start with \r\r or \r. This vulnerability exists due to an incomplete fix for CVE-2022-2217.

Upgrade org.webjars.npm:parse-url to version 8.1.0 or higher.

org.webjars.npm:parse-url is an An advanced url parser supporting git urls too.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the parseUrl function, due to mishandling hostnames when processing usernames and passwords.

Upgrade org.webjars.npm:parse-url to version 6.0.1 or higher.

org.webjars.npm:parse-url is an An advanced url parser supporting git urls too.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of special characters for ASCII that start with \x and also for all Unicodes start with \u.

Upgrade org.webjars.npm:parse-url to version 6.0.1 or higher.

org.webjars.npm:parse-url is an An advanced url parser supporting git urls too.

Affected versions of this package are vulnerable to Information Exposure due to improper validation.

Upgrade org.webjars.npm:parse-url to version 6.0.1 or higher.