<p>Upgrade <code>url-js</code> to version 2.1.0 or higher.</p>

Improper Input Validation Affecting url-js package, versions <2.1.0

Snyk CVSS

Attack Complexity Low

Threat Intelligence

Exploit Maturity Proof of concept

EPSS 0.07% (28^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JS-URLJS-2414030
published 7 Mar 2022
disclosed 28 Feb 2022
credit Pocas

Report a new vulnerability Found a mistake?

Introduced: 28 Feb 2022

CVE-2022-25839 Open this link in a new tab CWE-20 Open this link in a new tab First added by Snyk

How to fix?

Upgrade url-js to version 2.1.0 or higher.

Overview

url-js is a Simple URL parser, similar to DOM URL

Affected versions of this package are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.

PoC:

Running the following command:

node -e "const URLJS = require('url-js');console.log(URLJS('http://\\\\localhost'))"

Will result in the following output:

URLJS {
  protocol: 'http:',
  username: '',
  password: '',
  hostname: '\\localhost',
  port: '',
  pathname: '/',
  search: '',
  query: '',
  hash: ''
}

References

Fix Commit