CVE-2022-24723 Improper Input Validation in URI.js
URI.js fails to strip leading whitespace from protocols, causing improper URL parsing and potential security bypasses in applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24723?
CVE-2022-24723 is a medium-severity vulnerability in medialize URI.js, published on 3 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.
Weakness: CWE-20
Which versions are affected by CVE-2022-24723?
2 open source packages ship an affected version, including urijs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
urijs npm | All versions | 1.19.9 |
urijs npm | All versions | 1.19.9 |
Products include Uri.js Project Uri.js.
How do I fix CVE-2022-24723?
Upgrade urijs to 1.19.9 or later.
Is CVE-2022-24723 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24723 exists.
Other vulnerabilities in medialize URI.js
- CVE-2022-0868 Open Redirect in medialize/uri.js
- CVE-2021-27516 URIjs Hostname spoofing via backslashes in URL
- CVE-2022-1243 CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js
- CVE-2022-1233 URL Confusion When Scheme Not Supplied in medialize/uri.js
- CVE-2020-26291 Hostname spoofing in URI.js
Sources
Also known as GHSA-gmv4-r438-p67f, UBUNTU-CVE-2022-24723.