\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.

This can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or Javascript (see following example): const parse = require('urijs') const express = require('express') const app = express() const port = 3000

input = "ja\r\nvascript:alert(1)" url = parse(input)

console.log(url)

app.get('/', (req, res) => { if (url.protocol !== "javascript:") {res.send("<iframe src=\'" + input + "\'>CLICK ME!</iframe>")} })

app.listen(port, () => { console.log(Example app listening on port ${port}) })

URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.

Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash (\) character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: https:/\expected-example.com/path Escaped string: https:/\\expected-example.com/path (JavaScript strings must escape backslash)

Affected versions incorrectly return no hostname. Patched versions correctly return expected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class.

Patches Version 1.19.6 is patched against all known payload variants.

References https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for this particular bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass) PR #233 (initial fix for backslash handling)

For more information If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js

Reporter credit Yaniv Nizry from the CxSCA AppSec team at Checkmarx

A flaw was found in urijs. The hostname can be spoofed by using a backslash (\) character followed by an at (@) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Affected versions of uri-js is susceptible to a regular expression denial of service vulnerability when user input is sent to the .parse() method.

Recommendation

Update to v3.0.0 or later.