Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

lambdaisland:uri

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5MavenPublished

    lambdaisland/uri authority-regex returns the wrong authority

    CVE-2023-28628 · GHSA-cp4w-6x4w-v2h5

    Affected
    • Maven lambdaisland:uri < 1.14.120
    Fixed in
    1.14.120· Vendor fix available
    Issue
    authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to CVE-2020-8910. Details https://github.com/lambdaisland/uri/blob/d3355fcd3e235238f4dcd37be97787a84e580072/src/lambdaisland/uri.cljc#L9 This regex doesn't handle the backslash (\) character in the username correctly, leading to a wrong output. Payload: https://example.com\\@google.com The returned host is google.com, but the correct host should be example.com. urllib3 (Python) and google-closure-library (Javascript) return example.com as the host. Here the correct (or current) regex used by google-closure-library: https://github.com/google/closure-library/blob/0e567abedb058e9b194a40cfa3ad4c507653bccf/closure/goog/uri/utils.js#L189 PoC Impact The library returns the wrong authority, and it can be abused to bypass host restrictions. Reference WHATWG Living URL spec, section 4.4 URL Parsing, host state:…

    Recommended action: Upgrade to 1.14.120 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →