CVE-2018-3774 Open Redirect in url-parse
Incorrect URL parsing allows attackers to bypass authentication, trigger SSRF, or cause open redirects in applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-3774?
CVE-2018-3774 is a critical server-side request forgery vulnerability in HackerOne url-parse, published on 12 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
Which versions are affected by CVE-2018-3774?
2 open source packages ship an affected version, including url-parse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
url-parse npm | From 1.0.0 | 1.4.3 |
url-parse npm | From 1.0.0 | 1.4.3 |
Products include Url-Parse Project Url-Parse.
How do I fix CVE-2018-3774?
Upgrade url-parse to 1.4.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2018-3774 being exploited?
There is no known exploitation of CVE-2018-3774 in the wild and no public exploit code.
Other vulnerabilities in HackerOne url-parse
- CVE-2022-0512 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
- CVE-2022-0691 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
- CVE-2022-0686 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
- CVE-2022-0639 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
- CVE-2021-3664 Open Redirect in unshiftio/url-parse
Sources
Also known as DEBIAN-CVE-2018-3774, GHSA-pv4c-p2j5-38j4, UBUNTU-CVE-2018-3774.