If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (\) and slash (/) characters as part of the scheme delimiter, e.g. scheme:/\/\/\hostname. If the hostname is used in security decisions, the decision may be incorrect.
Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.
Example URL: https:/\/\/\expected-example.com/path
Escaped string: https:/\\/\\/\\expected-example.com/path (JavaScript strings must escape backslash)
Affected versions incorrectly return no hostname. Patched versions correctly return expected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class.
Patches
Version 1.19.7 is patched against all known payload variants.
medialize/URI.js
### [`v1.19.7`](https://togithub.com/medialize/URI.js/blob/master/CHANGELOG.md#1197-July-14th-2021-)
[Compare Source](https://togithub.com/medialize/URI.js/compare/v1.19.6...v1.19.7)
- **SECURITY** fixing [`URI.parseQuery()`](http://medialize.github.io/URI.js/docs.html#static-parseQuery) to prevent overwriting `__proto__` in parseQuery() - disclosed privately by [@NewEraCracker](https://togithub.com/NewEraCracker)
- **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) to handle variable amounts of `\` and `/` in scheme delimiter as Node and Browsers do - disclosed privately by [ready-research](https://togithub.com/ready-research) via https://huntr.dev/
- removed obsolete build tools
- updated jQuery versions (verifying compatibility with 1.12.4, 2.2.4, 3.6.0)
Configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, click this checkbox.
This PR contains the following updates:
1.19.6->1.19.7GitHub Vulnerability Alerts
CVE-2021-3647
Impact
If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (
\) and slash (/) characters as part of the scheme delimiter, e.g.scheme:/\/\/\hostname. If the hostname is used in security decisions, the decision may be incorrect.Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.
Example URL:
https:/\/\/\expected-example.com/pathEscaped string:https:/\\/\\/\\expected-example.com/path(JavaScript strings must escape backslash)Affected versions incorrectly return no hostname. Patched versions correctly return
expected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class.Patches
Version 1.19.7 is patched against all known payload variants.
References
https://github.com/medialize/URI.js/releases/tag/v1.19.7 (fix for this particular bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass) PR #233 (initial fix for backslash handling)
For more information
If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js
Reporter credit
ready-research via https://huntr.dev/
Release Notes
medialize/URI.js
### [`v1.19.7`](https://togithub.com/medialize/URI.js/blob/master/CHANGELOG.md#1197-July-14th-2021-) [Compare Source](https://togithub.com/medialize/URI.js/compare/v1.19.6...v1.19.7) - **SECURITY** fixing [`URI.parseQuery()`](http://medialize.github.io/URI.js/docs.html#static-parseQuery) to prevent overwriting `__proto__` in parseQuery() - disclosed privately by [@NewEraCracker](https://togithub.com/NewEraCracker) - **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) to handle variable amounts of `\` and `/` in scheme delimiter as Node and Browsers do - disclosed privately by [ready-research](https://togithub.com/ready-research) via https://huntr.dev/ - removed obsolete build tools - updated jQuery versions (verifying compatibility with 1.12.4, 2.2.4, 3.6.0)Configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.