Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries

[silversurfer]

Content source

https://thehackernews.com/2022/01/researchers-find-bugs-in-over-dozen.html

A study of 16 different Uniform Resource Locator (URL) parsing libraries has unearthed inconsistencies and confusions that could be exploited to bypass validations and open the door to a wide range of attack vectors.

In a deep-dive analysis jointly conducted by cybersecurity firms Claroty and Synk, eight security vulnerabilities were identified in as many third-party libraries written in C, JavaScript, PHP, Python, and Ruby languages and used by several web applications.

"The confusion in URL parsing can cause unexpected behavior in the software (e.g., web application), and could be exploited by threat actors to cause denial-of-service conditions, information leaks, or possibly conduct remote code execution attacks," the researchers said in a report shared with The Hacker News.

With URLs being a fundamental mechanism by which resources — located either locally or on the web — can be requested and retrieved, differences in how the parsing libraries interpret a URL request could pose significant risk for users.

Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries

Vulnerabilities found in 16 different widely used URL parsing libraries that can open the door to a variety of attack vectors.

thehackernews.com