Authorization Bypass in Node.js due to Trailing White Space in HTTP Header Values
Summary
CVE-2019-15606: Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons. Affects nodejs across 2 version ranges.
< 10.19.0-r0
>= cf41627411886000429bde058a6594fb7f6d6d47, < 5ba7df3c4b81ab695029dacf34a0aa960be71372
Fixed in 10.19.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. However, versions 10, 12, and 13 of Node.js are vulnerable to an authorization bypass issue when trailing white space is included in HTTP header values. This vulnerability can lead to unauthorized access to protected resources.
Vulnerability Detail
The vulnerability arises from a flaw in the comparison of header values. By including trailing white space in the header values, an attacker can bypass authorization checks that rely on exact header value matches. This can allow them to access sensitive resources or perform actions that should be restricted. The impact of this vulnerability can be severe, as it undermines the integrity of access control mechanisms.
How To Fix
Minimum fixed version
10.19.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is advised to sanitize and trim HTTP header values before performing any comparisons. This can help mitigate the risk of unauthorized access due to trailing white space. Here is an example of how to sanitize header values in Node.js:
const sanitizedValue = req.headers['header-name'].trim();
Conclusion
The authorization bypass vulnerability in Node.js due to trailing white space in HTTP header values can have serious consequences, allowing unauthorized access to protected resources. It is crucial to update to the fixed versions of Node.js and sanitize header values to mitigate the risk. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
The vulnerability allows attackers to bypass authorization checks based on header value comparisons, potentially leading to unauthorized access to protected resources.
Versions 10, 12, and 13 of Node.js are affected by this vulnerability.
To fix this vulnerability, update Node.js to the fixed versions: 10.19.0-r0 or 12.15.0-r0.
Yes, you can sanitize and trim HTTP header values before performing comparisons to mitigate the risk of unauthorized access.
You can find more information about this vulnerability in the CVE-2019-15606 JSON report: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15606.json
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
