Fix CVE–2018–3774

[debricked-staging]

CVE–2018–3774

Vulnerable dependency:     url-parse (Yarn)    1.0.5    1.1.9

Vulnerability details

Description

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

GitHub

Open Redirect in url-parse

Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.

Recommendation

Update to version 1.4.3 or later.

NVD

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

CVSS details - 10

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Changed
Confidentiality	High
Integrity	High
Availability	High

References

    NVD - CVE-2018-3774
    Open Redirect in url-parse · CVE-2018-3774 · GitHub Advisory Database · GitHub
    [security] Sanitize paths, hosts before parsing. · unshiftio/url-parse@53b1794 · GitHub
    HackerOne
    [security] Added missing SECURITY.md · unshiftio/url-parse@d7b582e · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE