CVE-2023-28628 — lambdaisland/uri is a pure Clojure/ClojureScript URI library

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910.

01What is this vulnerability?

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in question doesn't handle the backslash (`\`) character in the username correctly, leading to a wrong…

02Affected products

Vendor	Product	Versions
lambdaisland	uri	< 1.14.120

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

08Timeline

• Published: 2023-03-27T20:20:08.358Z
• Last modified: 2025-02-19T15:21:18.308Z

09References

• github.com — https://github.com/lambdaisland/uri/security/advisories/GHSA-cp4w-6x4w-v2h5
• github.com — https://github.com/lambdaisland/uri/commit/f46db3e84846f79e14bfee0101d9c7a872321…