Description
\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.
This can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or Javascript (see following example):
Recommendation
Update the urijs package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.19.11
- Patched version(s): 1.19.11
References
Could your website be exposed too?
SmartScanner can check your website for Incorrect protocol extraction via \r, \n and \t characters and gives you actionable findings to investigate.
Start a free scanRelated Issues
- matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion - CVE-2022-39251
- url-parse incorrectly parses hostname / protocol due to unstripped leading control characters. - CVE-2022-0691
- Leading white space bypasses protocol validation - CVE-2022-24723
- cookiejar Regular Expression Denial of Service via Cookie.parse function - CVE-2022-25901
You might also like:
See something that needs correcting? Let us knowUpdated November 29, 2023