Multiple vulnerabilities in IonicaBizau parse-url for Node.js



Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2022-3224
CVE-2022-2900
CWE-ID CWE-451
CWE-918
Exploitation vector Network
Public exploit N/A
Vulnerable software
 parse-url
Web applications / JS libraries

Vendor IonicaBizau

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Spoofing attack

EUVDB-ID: #VU67942

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-3224

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data, such as protocol or hostname. A remote attacker can spoof page content.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

parse-url: 3.0.0 - 8.0.0

CPE2.3 External links

https://github.com/ionicabizau/parse-url/commit/9cacf38de02db0fb1358bd6ec04543e523cd6a8e
https://huntr.dev/bounties/3587a567-7fcd-4702-b7c9-d9ca565e3c62


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU67941

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-2900

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

parse-url: 3.0.0 - 8.0.0

CPE2.3 External links

https://github.com/ionicabizau/parse-url/commit/b88c81df8f4c5168af454eaa4f92afa9349e4e13
https://huntr.dev/bounties/1b4c972a-abc8-41eb-a2e1-696db746b5fd


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###