CVE-2022-0512: Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
An authorization bypass vulnerability was found in nodes-url-parse. This flaw allows a remote attacker with a basic user account to evade hostname verification by inserting the at symbol "@" at the end of the password field. This issue can allow entry to systems designed to block remote access and may not have additional defenses.
Other sources
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
unshift.io url-parse module for NPM could allow a remote attacker to bypass security restrictions, caused by improperly handeling username and password. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass hostname validation.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/node-url-parseto a version that resolves this vulnerability.Fixed in 1.5.10+~1.4.8-2Fixed in 1.5.10+~1.4.8-3Fixed in 1.5.10+~1.4.11-1 - Upgrade
Upgrade
debian/node-url-parseto a version that resolves this vulnerability.Fixed in 1.5.7-1 - Upgrade
Upgrade
npm/url-parseto a version that resolves this vulnerability.Fixed in 1.5.6
Event History
Frequently Asked Questions
What is CVE-2022-0512?
CVE-2022-0512 is an authorization bypass vulnerability found in nodes-url-parse.
How does CVE-2022-0512 work?
CVE-2022-0512 allows a remote attacker with a basic user account to bypass hostname verification by inserting the at symbol "@" at the end of the password field.
What is the severity of CVE-2022-0512?
CVE-2022-0512 has a severity value of 8.8, which is classified as high.
How can I fix CVE-2022-0512?
To fix CVE-2022-0512, users should update url-parse to version 1.5.6 or higher.
Where can I find more information about CVE-2022-0512?
You can find more information about CVE-2022-0512 in the references provided: [link1], [link2], [link3].