CVE-2022-24723: Improper Input Validation in URI.js
An improper input validation flaw was found in urijs where white space characters are not removed from the beginning of an URL. This issue allows bypassing the protocol validation.
Other sources
URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/urijsto a version that resolves this vulnerability.Fixed in 1.19.9 - Upgrade
Upgrade
URI.jsto a version that resolves this vulnerability.Fixed in 1.19.9 - Compensating control
Workaround: remove leading whitespace characters from values before passing them to URI.parse (up to the vulnerable condition in versions before 1.19.9).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-24723?
CVE-2022-24723 is an improper input validation flaw in urijs where white space characters are not removed from the beginning of the protocol, causing URLs to not be parsed properly.
What is the severity of CVE-2022-24723?
The severity of CVE-2022-24723 is medium with a severity value of 5.3.
How does CVE-2022-24723 impact urijs?
CVE-2022-24723 impacts urijs by allowing white space characters at the beginning of the protocol, which leads to incorrect URL parsing.
How can CVE-2022-24723 be fixed?
CVE-2022-24723 can be fixed by upgrading to version 1.19.9 of urijs, which has a patch for the issue.
What are the references for CVE-2022-24723?
The references for CVE-2022-24723 are: [1] GitHub Advisory - GHSA-gmv4-r438-p67f, [2] Huntr.dev Bounty - 82ef23b8-7025-49c9-b5fc-1bb9885788e5, [3] GitHub Commit - 86d10523a6f6e8dc4300d99d671335ee362ad316.