CVE-2020-26291 (JavaScript, published 2020-12-31T00:15Z)
Description: value: URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/medialize/URI.js
Files changed:
src/URI.js
test/urls.js
Commit message: fix(parse): treat backslash as forwardslash in authority (#403)

make `https://attacker.com\\@example.com` like `https://attacker.com\\@example.com/` result in `https://attacker.com/@example.com`

Vulnerable code:
    var slash = firstBackSlash === -1 ? firstSlash : (firstSlash !== -1 ? Math.min(firstBackSlash, firstSlash): firstSlash)
    if (pos > -1 && (slash === -1 || pos < slash)) {
      string = string.substring(pos + 1);

Fixed code:
    var _string = string
    if (firstBackSlash !== -1) {
      string = string.replace(/\\/g, '/')
    }
    if (pos > -1 && (firstSlash === -1 || pos < firstSlash)) {
      string = _string.substring(pos + 1);
    }, {
      name: 'backslashes authority, no ending slash',
      url: 'https://attacker.com\\@example.com',
      _url: 'https://attacker.com/@example.com',
      parts: {
        protocol: 'https',
        username: null,
        password: null,
        hostname: 'attacker.com',
        port: null,
        path: '/@example.com',
        query: null,
        fragment: null
      },
      accessors: {
        protocol: 'https',
        username: '',
        password: '',
        port: '',
        path: '/@example.com',
        query: '',
        fragment: '',
        resource: '/@example.com',
        authority: 'attacker.com',
        origin: 'https://attacker.com',
        userinfo: '',
        subdomain: '',
        domain: 'attacker.com',
        tld: 'com',
        directory: '/',
        filename: '@example.com',
        suffix: 'com',
        hash: '',
        search: '',
        host: 'attacker.com',
        hostname: 'attacker.com'
      },
      is: {
        urn: false,
        url: true,
        relative: false,
        name: true,
        sld: false,
        ip: false,
        ip4: false,
        ip6: false,
        idn: false,
        punycode: false
      }