# Abusing URI Parsers for fun and profit

URI parser treats trailing-dot FQDN as unequal to bare host, letting attackers bypass host-based access checks to read restricted files.

- Payout: $500
- Severity: medium
- Program: -
- Credited: Mohammad Owais
- Disclosed: 2021-02-08
- Write-up quality: 6/10
- Original: https://huntingreads.com/abusing-uri-parsers-for-fun-and-profit/
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntingreads-com-abusing-uri-parsers-for-fun-and-profit
- Tags: domain:web impact:data-leak kind:bounty platform:blog sev:medium tech:nodejs technique:source-review vuln:access-control vuln:path-traversal

**Target:** URI/URL parsing library used for host comparison logic
**Root cause:** Parser's isequal() does not normalize the trailing root-label dot per RFC 1034, so 'abc.com' and 'abc.com.' compare unequal even though they resolve to the same host.
**Steps:**
1. Observe RFC 1034: 'https://abc.com' equals 'https://abc.com.' (absolute FQDN).
2. Test `redacted.isequal("https://abc.com", "https://abc.com.")` returns false.
3. Build Node server that blocks `http://127.0.0.1/some-sensitive-file.txt` via isequal check.
4. Send `curl -v http://127.0.0.1./some-sensitive-file.txt -H "Host: 127.0.0.1."` to bypass the check and read the file.
**How found:** Author had prior experience analyzing how URI parsers handle URLs, then read RFC 1034 noting the trailing-dot equivalence and tested the framework's isequal() with dotted variants, finding mismatches.
**Exploitation:** Attacker appends a trailing dot to the Host header/hostname so the parser's equality check against the protected URL fails, causing the app to fall through to the file-read branch and serve the restricted file.
**Insight:** When a target uses a URL/URI parser for security decisions (allowlists, SSRF filters, redirect validation), test RFC-equivalent-but-textually-different forms like trailing-dot FQDNs, case differences, and default ports against the parser's equality/normalization functions.