Fix CVE–2018–3774

[debricked]

CVE–2018–3774

Vulnerable dependency:     url-parse (Yarn)    1.0.5    1.2.0

Vulnerability details

Description

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

NVD

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

GitHub

Open Redirect in url-parse

Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.

Recommendation

Update to version 1.4.3 or later.

CVSS details - 10

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Changed
Confidentiality	High
Integrity	High
Availability	High

References

    [security] Sanitize paths, hosts before parsing. · unshiftio/url-parse@53b1794 · GitHub
    [security] Added missing SECURITY.md · unshiftio/url-parse@d7b582e · GitHub
    HackerOne
    NVD - CVE-2018-3774
    Open Redirect in url-parse · CVE-2018-3774 · GitHub Advisory Database · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE