Lucene search
Veracode Vulnerability DatabaseVERACODE:37044HistorySep 16, 2022 - 4:03 a.m.
Hostname Spoofing
2022-09-1604:03:16
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
21
parseurl
hostname spoofing
index.js
software vulnerability
ssh url
EPSS
0.001
Percentile
30.0%
parse-url is vulnerable to hostname spoofing. The vulnerability exists because the parseUrl function of index.js does not properly identify the custom user in ssh url and hostname, allowing an attacker to gain sensitive information by redirecting to the malicious urls.
References
github.com/advisories/GHSA-pqw5-jmp5-px4v
github.com/IonicaBizau/parse-url/commit/9500430a3b9973bb1b5b2b9b319af2685ad272b3
github.com/ionicabizau/parse-url/commit/9cacf38de02db0fb1358bd6ec04543e523cd6a8e
github.com/IonicaBizau/parse-url/pull/60
huntr.dev/bounties/3587a567-7fcd-4702-b7c9-d9ca565e3c62
huntr.dev/bounties/3587a567-7fcd-4702-b7c9-d9ca565e3c62/
Related
github
github
prion
prion
Design/Logic Flaw
2022-09-15 12:15:00
nvd
nvd
CVE-2022-3224
2022-09-15 12:15:09
cve
cve
CVE-2022-3224
2022-09-15 12:15:09
huntr
huntr
Hostname Spoofing
2022-08-07 08:02:17
osv
osv
parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing
2022-09-16 00:00:39
CVE-2022-3224
2022-09-15 12:15:09
cvelist
cvelist
CVE-2022-3224 Misinterpretation of Input in ionicabizau/parse-url
2022-09-15 11:30:12
