CVE-2022-1233 (published 2022-04-04T20:15Z)

URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/medialize/uri.js
commit_details: repo_url: https://github.com/medialize/uri.js
author: Rodney Rehm
author_date: 2022-04-03 10:51:52+02:00
msg: fix(parse): handle excessive slashes in scheme-relative URLs

reported by @zeyu2001 via huntr.dev
repository: repo_url: https://github.com/medialize/uri.js
repo_name: medialize/URI.js
description: Javascript URL mutation library
repo_language: JavaScript
owner: medialize
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -2,6 +2,10 @@
 
 The release notes tracked in this document are also made available on the [releases page](https://github.com/medialize/URI.js/releases)
 
+### master ###
+
+* **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) handle excessive slashes in scheme-relative URLs - disclosed by [zeyu2001](https://github.com/zeyu2001) via https://huntr.dev/
+
 ### 1.19.10 (March 5th 2022) ###
 
 * **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) handle excessive colons in protocol delimiter - disclosed by [huydoppa](https://github.com/huydoppa) via https://huntr.dev/

programming_language: Markdown
filename: URI.js
change_type: ModificationType.MODIFY
diff: @@ -518,6 +518,8 @@
 
     // slashes and backslashes have lost all meaning for the web protocols (https, http, wss, ws)
     string = string.replace(/^(https?|ftp|wss?)?:+[/\\]*/i, '$1://');
+    // slashes and backslashes have lost all meaning for scheme relative URLs
+    string = string.replace(/^[/\\]{2,}/i, '//');
 
     // extract protocol
     if (string.substring(0, 2) === '//') {

programming_language: JavaScript
filename: urls.js
change_type: ModificationType.MODIFY
diff: @@ -581,6 +581,55 @@ var urls = [{
       idn: false,
       punycode: false
     }
+  }, {
+    name: 'ignoring scheme excessive slashes',
+    url: ':/\\//user:pass@example.org:123/some/directory/file.html?query=string#fragment',
+    _url: '//user:pass@example.org:123/some/directory/file.html?query=string#fragment',
+    parts: {
+      protocol: null,
+      username: 'user',
+      password: 'pass',
+      hostname: 'example.org',
+      port: '123',
+      path: '/some/directory/file.html',
+      query: 'query=string',
+      fragment: 'fragment'
+    },
+    accessors: {
+      protocol: '',
+      username: 'user',
+      password: 'pass',
+      port: '123',
+      path: '/some/directory/file.html',
+      query: 'query=string',
+      fragment: 'fragment',
+      resource: '/some/directory/file.html?query=string#fragment',
+      authority: 'user:pass@example.org:123',
+      origin: 'user:pass@example.org:123',
+      userinfo: 'user:pass',
+      subdomain: '',
+      domain: 'example.org',
+      tld: 'org',
+      directory: '/some/directory',
+      filename: 'file.html',
+      suffix: 'html',
+      hash: '#fragment',
+      search: '?query=string',
+      host: 'example.org:123',
+      hostname: 'example.org'
+    },
+    is: {
+      urn: false,
+      url: true,
+      relative: false,
+      name: true,
+      sld: false,
+      ip: false,
+      ip4: false,
+      ip6: false,
+      idn: false,
+      punycode: false
+    }
   }, {
     name: 'scheme-relative URL',
     url: '//www.example.org/',
@@ -629,6 +678,55 @@ var urls = [{
       idn: false,
       punycode: false
     }
+  }, {
+    name: 'scheme-relative URL excessive slashes',
+    url: '//\\/www.example.org/',
+    _url: '//www.example.org/',
+    parts: {
+      protocol: null,
+      username: null,
+      password: null,
+      hostname: 'www.example.org',
+      port: null,
+      path: '/',
+      query: null,
+      fragment: null
+    },
+    accessors: {
+      protocol: '',
+      username: '',
+      password: '',
+      port: '',
+      path: '/',
+      query: '',
+      fragment: '',
+      resource: '/',
+      authority: 'www.example.org',
+      origin: 'www.example.org',
+      userinfo: '',
+      subdomain: 'www',
+      domain: 'example.org',
+      tld: 'org',
+      directory: '/',
+      filename: '',
+      suffix: '',
+      hash: '',
+      search: '',
+      host: 'www.example.org',
+      hostname: 'www.example.org'
+    },
+    is: {
+      urn: false,
+      url: true,
+      relative: false,
+      name: true,
+      sld: false,
+      ip: false,
+      ip4: false,
+      ip6: false,
+      idn: false,
+      punycode: false
+    }
   }, {
     name: 'missing authority',
     url: 'food:///test/file.csv',

programming_language: CoffeeScript