CVE-2022-0686: Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
An authorization bypass flaw was found in url-parse. While submitting a URL, a local unauthenticated attacker can add a trailing colon (:), but omit the port number. This issue enables an open redirect that allows the exposure of sensitive information or spamming of infrastructure outside the vulnerable server.
Other sources
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
Authorization Bypass Through User-Controlled Key in NPM url-parse.
Reference:
https://huntr.dev/bounties/55fd06cd-9054-4d80-83be-eb5a454be78c https://github.com/unshiftio/url-parse/commit/d5c64791ef496ca5459ae7f2176a31ea53b127e5
— Red Hat
unshift.io url-parse module for NPM could allow a remote attacker to bypass security restrictions, caused by an issue with unable to find the correct hostname when no port number is provided in the url. By sending a specially-crafted request, an attacker could exploit this vulnerability to perform SSRF, open redirect or other attacks depends on the hostname field of parsed url.
— IBM
url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-0686?
CVE-2022-0686 is an authorization bypass vulnerability in url-parse prior to version 1.5.8.
What is the severity of CVE-2022-0686?
CVE-2022-0686 has a severity rating of 9.1 (Critical).
How can an attacker exploit CVE-2022-0686?
An attacker can exploit CVE-2022-0686 by adding a trailing colon (:) without the port number while submitting a URL, which enables an open redirect that can expose sensitive information or spam infrastructure.
What is the remedy for CVE-2022-0686?
The remedy for CVE-2022-0686 is to update url-parse to version 1.5.8 or higher.
Where can I find more information about CVE-2022-0686?
You can find more information about CVE-2022-0686 at the following references: [Reference 1](https://huntr.dev/bounties/55fd06cd-9054-4d80-83be-eb5a454be78c), [Reference 2](https://github.com/unshiftio/url-parse/commit/d5c64791ef496ca5459ae7f2176a31ea53b127e5), [Reference 3](https://github.com/RedHatInsights/ocp-advisor-frontend/blob/prod-stable/package-lock.json).