Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

Vulnerability

The vulnerability resides in the url-parse npm package, affecting all versions from 0.1.0 to before 1.5.9 [3]. The library uses a regular expression (whitespace) to strip leading whitespace from URLs, but this regex only removes a limited set of whitespace characters (e.g., space, tab, newline). However, many other Unicode control characters (e.g., null byte, carriage return, and various Unicode space characters in the range \x00-\x20 and beyond) are not stripped [4]. An attacker can prepend these control characters to the URL string, and the parser incorrectly interprets the hostname and protocol, leading to an authorization bypass through user-controlled key [2].

Exploitation

The attacker does not need any special network position or authentication; the vulnerability is triggered when a user-controlled URL string is parsed by the vulnerable url-parse method. The attacker can craft a URL with leading control characters (e.g., null bytes or other whitespace-like characters) that are not removed by the trimLeft function. When passed to the constructor, the parser misparses the URL, potentially treating the hostname or protocol differently than expected. The exploitation requires no user interaction beyond the application processing the attacker-supplied URL [1][4].

Impact

Successful exploitation allows an attacker to bypass authorization checks. Since the parser incorrectly identifies the hostname or protocol, the attacker can craft URLs that appear to reference a trusted origin but actually point to a malicious one, leading to potential information disclosure, phishing, or server-side request forgery (SSRF) depending on how the parsed URL is used by the application. The impact is scope-dependent, but can result in the attacker controlling a key value used for authorization decisions [2].

Mitigation

A fix was implemented in commit 0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63, which updates the whitespace regex to include all control characters in the range \x00-\x20 [4]. The vulnerability is fully resolved in version 1.5.9 of the url-parse package. Users should upgrade to version 1.5.9 or later. No workarounds are known for versions prior to 1.5.9 other than upgrading. Versions 0.0.0-0.0.4 are not affected [3]. The CVE is not listed on KEV as of the publication date.