Incorrect protocol extraction via \r, \n and \t characters

Description

\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.

This can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or Javascript (see following example): `

Recommendation

Update the urijs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.19.11
• Patched version(s): 1.19.11

References

• GHSA-3vjf-82ff-p4r3
• huntr.dev
• CVE-2022-1243
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• URIjs Hostname spoofing via backslashes in URL - CVE-2021-27516
• Open Redirect in urijs - CVE-2022-0868
• Leading white space bypasses protocol validation - CVE-2022-24723
• Authorization Bypass Through User-Controlled Key in urijs - CVE-2022-0613

Tags:

npm

urijs