Remote Code Execution Vulnerability in Node.js
Summary
CVE-2018-7160: The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. Affects nodejs across 2 version ranges.
>= 6b1c40be84fbe5ea404f25e4e340a0c1fe67a60a, < 2c93af2da3b696e2389ba46608efb9bdffd8badd
< 8.11.0-r0
Fixed in 8.11.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. However, Node.js versions 6.x and later are vulnerable to a remote code execution vulnerability due to a flaw in the Node.js inspector. This vulnerability can be exploited through a DNS rebinding attack, allowing an attacker to execute arbitrary code on the affected system.
Vulnerability Detail
The vulnerability arises from the ability of a malicious website to bypass same-origin-policy checks and establish HTTP connections to localhost or hosts on the local network. If a Node.js process with the debug port active is running on the same computer or a computer with network access, the attacker can connect to it as a debugger and gain full code execution access. This can lead to unauthorized access, data theft, or further compromise of the system.
How To Fix
Minimum fixed version
8.11.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the Node.js package is not immediately feasible, a temporary workaround is to disable the debug port or restrict access to it. This can be done by modifying the Node.js configuration or firewall rules to block incoming connections on the debug port (default is 9229). However, this workaround may impact debugging capabilities and should only be considered as a temporary measure until the package can be updated.
Conclusion
The remote code execution vulnerability in Node.js can have severe consequences if left unpatched. It is crucial to update the Node.js package to version 8.11.0-r0 or later to mitigate the risk. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
A DNS rebinding attack is a technique where an attacker tricks a victim's web browser into making requests to a different IP address than the one originally intended. This allows the attacker to bypass same-origin-policy checks and establish connections to local resources.
Yes, this vulnerability can be exploited remotely if a user visits a malicious website while having a Node.js process with the debug port active running on their computer or a computer with network access.
The consequences of this vulnerability include unauthorized access to the affected system, data theft, and potential further compromise of the system. An attacker can execute arbitrary code with the privileges of the Node.js process, leading to complete control over the system.
No, only Node.js versions 6.x and later are affected by this vulnerability. It is recommended to update to version 8.11.0-r0 or later to mitigate the risk.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
