CVE-2020-26291 Hostname spoofing in URI.js
Attackers can spoof hostnames in URI.js, potentially bypassing security checks like allowlists or causing SSRF and open redirects.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26291?
CVE-2020-26291 is a medium-severity vulnerability in medialize URI.js, published on 30 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]
Weakness: CWE-20
Which versions are affected by CVE-2020-26291?
2 open source packages ship an affected version, including urijs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
urijs npm | All versions | 1.19.4 |
urijs npm | All versions | 1.19.4 |
Products include Uri.js Project Uri.js.
How do I fix CVE-2020-26291?
Upgrade urijs to 1.19.4 or later.
Is CVE-2020-26291 being exploited?
There is no known exploitation of CVE-2020-26291 in the wild and no public exploit code.
Other vulnerabilities in medialize URI.js
- CVE-2022-0868 Open Redirect in medialize/uri.js
- CVE-2021-27516 URIjs Hostname spoofing via backslashes in URL
- CVE-2022-1243 CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js
- CVE-2022-1233 URL Confusion When Scheme Not Supplied in medialize/uri.js
- CVE-2022-24723 Improper Input Validation in URI.js
Sources
Also known as GHSA-3329-pjwv-fjpg.