koa-router-7.4.0.tgz: 8 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - koa-router-7.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/urijs/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (koa-router version)	Remediation Possible**
CVE-2021-27516	High	7.5	urijs-1.19.1.tgz	Transitive	8.0.6	✅
CVE-2022-0613	Medium	6.5	urijs-1.19.1.tgz	Transitive	N/A*	❌
CVE-2020-26291	Medium	6.5	urijs-1.19.1.tgz	Transitive	8.0.6	✅
CVE-2022-1243	Medium	6.1	urijs-1.19.1.tgz	Transitive	8.0.6	✅
CVE-2022-1233	Medium	6.1	urijs-1.19.1.tgz	Transitive	8.0.6	✅
CVE-2022-0868	Medium	6.1	urijs-1.19.1.tgz	Transitive	8.0.6	✅
CVE-2021-3647	Medium	6.1	urijs-1.19.1.tgz	Transitive	8.0.6	✅
CVE-2022-24723	Medium	5.3	urijs-1.19.1.tgz	Transitive	8.0.6	✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-27516

Vulnerable Library - urijs-1.19.1.tgz

URI.js is a Javascript library for working with URLs.

Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/urijs/package.json

Dependency Hierarchy:

• koa-router-7.4.0.tgz (Root Library)
  • ❌ urijs-1.19.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.

Publish Date: 2021-02-22

URL: CVE-2021-27516

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27516

Release Date: 2021-02-22

Fix Resolution (urijs): 1.19.6

Direct dependency fix Resolution (koa-router): 8.0.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0613

Vulnerable Library - urijs-1.19.1.tgz

URI.js is a Javascript library for working with URLs.

Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/urijs/package.json

Dependency Hierarchy:

• koa-router-7.4.0.tgz (Root Library)
  • ❌ urijs-1.19.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.

Publish Date: 2022-02-16

URL: CVE-2022-0613

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083/

Release Date: 2022-02-16

Fix Resolution: uri.js - v1.19.8

CVE-2020-26291

Vulnerable Library - urijs-1.19.1.tgz

URI.js is a Javascript library for working with URLs.

Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/urijs/package.json

Dependency Hierarchy:

• koa-router-7.4.0.tgz (Root Library)
  • ❌ urijs-1.19.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (\) character followed by an at (@) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL https://expected-example.com\@observed-example.com will incorrectly return observed-example.com if using an affected version. Patched versions correctly return expected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]

Publish Date: 2020-12-31

URL: CVE-2020-26291

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26291

Release Date: 2020-12-31

Fix Resolution (urijs): 1.19.4

Direct dependency fix Resolution (koa-router): 8.0.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-1243

Vulnerable Library - urijs-1.19.1.tgz

URI.js is a Javascript library for working with URLs.

Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/urijs/package.json

Dependency Hierarchy:

• koa-router-7.4.0.tgz (Root Library)
  • ❌ urijs-1.19.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.

Publish Date: 2022-04-05

URL: CVE-2022-1243

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7/

Release Date: 2022-04-05

Fix Resolution (urijs): 1.19.11

Direct dependency fix Resolution (koa-router): 8.0.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-1233

Vulnerable Library - urijs-1.19.1.tgz

URI.js is a Javascript library for working with URLs.

Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/urijs/package.json

Dependency Hierarchy:

• koa-router-7.4.0.tgz (Root Library)
  • ❌ urijs-1.19.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.

Publish Date: 2022-04-04

URL: CVE-2022-1233

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1233

Release Date: 2022-04-04

Fix Resolution (urijs): 1.19.11

Direct dependency fix Resolution (koa-router): 8.0.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0868

Vulnerable Library - urijs-1.19.1.tgz

URI.js is a Javascript library for working with URLs.

Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/urijs/package.json

Dependency Hierarchy:

• koa-router-7.4.0.tgz (Root Library)
  • ❌ urijs-1.19.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.

Publish Date: 2022-03-06

URL: CVE-2022-0868

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0868

Release Date: 2022-03-06

Fix Resolution (urijs): 1.19.10

Direct dependency fix Resolution (koa-router): 8.0.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-3647

Vulnerable Library - urijs-1.19.1.tgz

URI.js is a Javascript library for working with URLs.

Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/urijs/package.json

Dependency Hierarchy:

• koa-router-7.4.0.tgz (Root Library)
  • ❌ urijs-1.19.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

URI.js is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2021-07-16

URL: CVE-2021-3647

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-89gv-h8wf-cg8r

Release Date: 2021-07-16

Fix Resolution (urijs): 1.19.7

Direct dependency fix Resolution (koa-router): 8.0.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24723

Vulnerable Library - urijs-1.19.1.tgz

URI.js is a Javascript library for working with URLs.

Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/urijs/package.json

Dependency Hierarchy:

• koa-router-7.4.0.tgz (Root Library)
  • ❌ urijs-1.19.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Publish Date: 2022-03-03

URL: CVE-2022-24723

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gmv4-r438-p67f

Release Date: 2022-03-03

Fix Resolution (urijs): 1.19.9

Direct dependency fix Resolution (koa-router): 8.0.6

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.