Vulnerability · Published Dec 30, 2020 · Assigned by GitHub_M
CVE-2020-26291Hostname spoofing in URI.js
Medium 6.5
In plain English
A medium-severity improper input validation in URI.js from medialize. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | urijs | 1.19.4 | GHSA-3329-pjwv-fjpg |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/medialize/URI.js/security/advisories/GHSA-3329-pjwv-fjpg x_refsource_CONFIRM
- https://www.npmjs.com/package/urijs x_refsource_MISC
- https://github.com/medialize/URI.js/releases/tag/v1.19.4 x_refsource_MISC
- https://github.com/medialize/URI.js/commit/b02bf037c99ac9316b77ff8bfd840e90becf1155 x_refsource_MISC