Summary
authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to CVE-2020-8910.
Details
|
(def authority-regex #?(:clj #"\A(([^:]*)(:(.*))?@)?([^:]*)(:(\d*))?\z" |
This regex doesn't handle the backslash (\) character in the username correctly, leading to a wrong output.
Payload: https://example.com\\@google.com
The returned host is google.com, but the correct host should be example.com.
urllib3 (Python) and google-closure-library (Javascript) return example.com as the host. Here the correct (or current) regex used by google-closure-library:
https://github.com/google/closure-library/blob/0e567abedb058e9b194a40cfa3ad4c507653bccf/closure/goog/uri/utils.js#L189
PoC
(ns poc.core)
(require '[lambdaisland.uri :refer (uri)])
(def myurl "https://example.com\\@google.com")
(defn -main
[]
(println myurl)
(println (:host (uri myurl)))
)
Impact
The library returns the wrong authority, and it can be abused to bypass host restrictions.
Reference
WHATWG Living URL spec, section 4.4 URL Parsing, host state: https://url.spec.whatwg.org/#url-parsing
Summary
authority-regexallows an attacker to send malicious URLs to be parsed by thelambdaisland/uriand return the wrong authority. This issue is similar to CVE-2020-8910.Details
uri/src/lambdaisland/uri.cljc
Line 9 in d3355fc
This regex doesn't handle the backslash (
\) character in the username correctly, leading to a wrong output.Payload:
https://example.com\\@google.comThe returned host is
google.com, but the correct host should beexample.com.urllib3(Python) andgoogle-closure-library(Javascript) returnexample.comas the host. Here the correct (or current) regex used bygoogle-closure-library:https://github.com/google/closure-library/blob/0e567abedb058e9b194a40cfa3ad4c507653bccf/closure/goog/uri/utils.js#L189
PoC
Impact
The library returns the wrong authority, and it can be abused to bypass host restrictions.
Reference
WHATWG Living URL spec, section 4.4 URL Parsing, host state: https://url.spec.whatwg.org/#url-parsing