GHSA-cp4w-6x4w-v2h5

Suggest an improvement
Source
https://github.com/advisories/GHSA-cp4w-6x4w-v2h5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-cp4w-6x4w-v2h5/GHSA-cp4w-6x4w-v2h5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cp4w-6x4w-v2h5
Aliases
Published
2023-03-27T22:31:13Z
Modified
2023-11-08T04:12:12Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
lambdaisland/uri `authority-regex` returns the wrong authority
Details

Summary

authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to CVE-2020-8910.

Details

https://github.com/lambdaisland/uri/blob/d3355fcd3e235238f4dcd37be97787a84e580072/src/lambdaisland/uri.cljc#L9

This regex doesn't handle the backslash (\) character in the username correctly, leading to a wrong output. Payload: https://example.com\\@google.com The returned host is google.com, but the correct host should be example.com.

urllib3 (Python) and google-closure-library (Javascript) return example.com as the host. Here the correct (or current) regex used by google-closure-library:

https://github.com/google/closure-library/blob/0e567abedb058e9b194a40cfa3ad4c507653bccf/closure/goog/uri/utils.js#L189

PoC

(ns poc.core)
(require '[lambdaisland.uri :refer (uri)])

(def myurl "https://example.com\\@google.com")

(defn -main
  []
   (println myurl)
   (println (:host (uri myurl)))
)

Impact

The library returns the wrong authority, and it can be abused to bypass host restrictions.

Reference

WHATWG Living URL spec, section 4.4 URL Parsing, host state: https://url.spec.whatwg.org/#url-parsing

Database specific 
{
    "cwe_ids":  [
        "CWE-601",
        "CWE-706"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-03-27T22:31:13Z",
    "nvd_published_at":  "2023-03-27T21:15:00Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / lambdaisland:uri

Package

Name
lambdaisland:uri
View open source insights on deps.dev
Purl
pkg:maven/lambdaisland/uri

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.14.120

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-cp4w-6x4w-v2h5/GHSA-cp4w-6x4w-v2h5.json"