Authorization Bypass Through User-Controlled Key in medialize/uri.js

Vulnerability

URIs (npm package urijs) prior to version 1.19.8 contain an authorization bypass vulnerability through user-controlled key [1][2]. The bug resides in the URL parsing function where the regular expression for matching scheme prefixes (e.g., https://) was not case-insensitive [3]. Under certain conditions, a crafted URL like hTTps://////attacker.com would be parsed incorrectly, treating the slash-heavy authority as part of the path or host, leading to inconsistent parsing results [3]. The fix addresses the issue by adding the i flag to the regex, making scheme matching case-insensitive and properly handling excessive slashes [3].

Exploitation

An attacker can craft a URL with a case-varied scheme (e.g., hTTps, HTTP) followed by multiple slashes and a malicious hostname. No special network position or authentication is required if the application uses urijs to parse and validate URL hostnames before making requests. The attacker supplies the crafted URL as user input (e.g., via a query parameter or API endpoint) that the application processes with urijs prior to 1.19.8. The parsing discrepancy causes the library to interpret the hostname differently than the actual target, potentially allowing the attacker to bypass host-based access controls or redirect the application to a different server.

Impact

Successful exploitation allows an attacker to bypass hostname validation or authorization checks, leading to information disclosure or server-side request forgery (SSRF) [1][2]. The attacker may gain the ability to make the application connect to an attacker-controlled host, potentially exposing sensitive data or performing actions under the application's privileges.

Mitigation

The vulnerability is fixed in urijs version 1.19.8, released on or around February 16, 2022 [1][2]. Users should upgrade to version 1.19.8 or later. No public workarounds have been identified for versions prior to the fix. The Fedora security team also issued package updates via the Fedora announcement list [4]. There is no indication this CVE is listed in the KEV catalog.