cve/2018/CVE-2018-3774.md

CVE-2018-3774

Description

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

POC

Reference

• https://hackerone.com/reports/384029

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/cxsca/appsec-pocs
• https://github.com/seal-community/patches