CVE-2022-0613: 
JavaScript vulnerability analysis and mitigation

CVE-2022-0613 is an Authorization Bypass Through User-Controlled Key vulnerability affecting NPM urijs versions prior to 1.19.8. The vulnerability was discovered and disclosed in February 2022, impacting the URI.js library which is widely used for URI parsing and manipulation (NVD, CVE).

The vulnerability stems from the case-sensitive protocol scheme validation in the URL parsing functionality. The issue specifically relates to how the library handles protocol schemes in URLs, where the fix for a previous vulnerability (CVE-2021-3647) did not properly account for case-sensitive protocol schemes. The CVSS v3.1 base score is 6.5 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (NVD).

The vulnerability could allow attackers to bypass authorization mechanisms through user-controlled keys, potentially leading to unauthorized access to resources. The impact affects both confidentiality and integrity with low severity, while availability is not impacted (NVD).

The vulnerability has been fixed in version 1.19.8 of the urijs package. Users are advised to upgrade to this version or later. The fix involves making the protocol scheme validation case-insensitive by adding the 'i' flag to the regular expression pattern (GitHub Commit).