CVE-2022-1243: CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js
\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.
This can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or Javascript (see following example): const parse = require('urijs') const express = require('express') const app = express() const port = 3000
input = "ja\r\nvascript:alert(1)" url = parse(input)
console.log(url)
app.get('/', (req, res) => { if (url.protocol !== "javascript:") {res.send("<iframe src=\'" + input + "\'>CLICK ME!</iframe>")} })
app.listen(port, () => { console.log(Example app listening on port ${port}) })
Other sources
CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-1243?
CVE-2022-1243 is a vulnerability where \r, \n, and \t characters in user-input URLs can lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.
What is the severity of CVE-2022-1243?
The severity of CVE-2022-1243 is high with a CVSS score of 7.2.
How does CVE-2022-1243 lead to XSS?
CVE-2022-1243 can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or JavaScript.
Which software versions are affected by CVE-2022-1243?
Versions of npm package urijs prior to 1.19.11 are affected by CVE-2022-1243.
How can CVE-2022-1243 be fixed?
To fix CVE-2022-1243, update to version 1.19.11 or later of the urijs npm package.