HTTP Request Smuggling in llhttp
Summary
CVE-2021-22959: The parser in accepts requests with a space (SP) right after the header name before the colon. Affects nodejs across 2 version ranges.
< 12.22.10-r0
< d6ea943d8d1c5092f4bf6e10a6a32cfb2dbeaae3
Fixed in 12.22.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The llhttp package is a parser used for handling HTTP requests. It is commonly used in the Node.js ecosystem, specifically in the Alpine Linux distribution. The package is responsible for parsing incoming HTTP requests and extracting relevant information from them. However, a vulnerability has been discovered in llhttp versions prior to v2.1.4 and v6.0.6 that allows for HTTP Request Smuggling (HRS). This vulnerability occurs when the parser accepts requests with a space (SP) right after the header name before the colon. This can lead to potential security risks and unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2021-22959, allows an attacker to exploit the llhttp parser's acceptance of requests with a space after the header name. By manipulating the request headers, an attacker can perform HTTP Request Smuggling attacks. This can lead to various consequences, including bypassing security measures, unauthorized access to sensitive data, and potential injection attacks. The vulnerability affects llhttp versions prior to v2.1.4 and v6.0.6.
How To Fix
Minimum fixed version
12.22.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to apply the fix by updating the llhttp package to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The HTTP Request Smuggling vulnerability in llhttp versions prior to v2.1.4 and v6.0.6 can lead to potential security risks and unauthorized access to sensitive information. It is crucial to update the llhttp package to the fixed version as soon as possible to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
llhttp is a parser used for handling HTTP requests in the Node.js ecosystem, specifically in the Alpine Linux distribution.
HTTP Request Smuggling (HRS) is a technique where an attacker manipulates the HTTP request headers to bypass security measures, gain unauthorized access, or perform injection attacks.
llhttp versions prior to v2.1.4 and v6.0.6 are affected by this vulnerability.
The potential consequences of this vulnerability include bypassing security measures, unauthorized access to sensitive data, and potential injection attacks.
To fix this vulnerability, update the llhttp package to version 2.1.4 or higher for llhttp v2.x.x and version 6.0.6 or higher for llhttp v6.x.x.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
