Description
Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.
Recommendation
Update the urijs package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.19.9
- Patched version(s): 1.19.9
References
Could your website be exposed too?
SmartScanner can check your website for Leading white space bypasses protocol validation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery - CVE-2022-41340
- url-parse incorrectly parses hostname / protocol due to unstripped leading control characters. - CVE-2022-0691
- Incorrect protocol extraction via \r, \n and \t characters - CVE-2022-1243
- Authorization Bypass Through User-Controlled Key in urijs - CVE-2022-0613
You might also like:
See something that needs correcting? Let us knowUpdated February 03, 2023