HTTP Request Splitting in Node.js
Summary
CVE-2018-12116: Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provide... Affects nodejs across 2 version ranges.
>= 6b1c40be84fbe5ea404f25e4e340a0c1fe67a60a, < b6589e3d9be963b29a8559bf7b272b54284fe1bc
< 8.14.0-r0
Fixed in 8.14.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications using event-driven, non-blocking I/O. This vulnerability affects versions of Node.js prior to 6.15.0 and 8.14.0. Node.js can be tricked into using unsanitized user-provided Unicode data for the path option of an HTTP request, leading to a second unexpected HTTP request being made to the same server.
Vulnerability Detail
The HTTP request splitting vulnerability in Node.js allows an attacker to manipulate the path option of an HTTP request with unsanitized user-provided Unicode data. By providing malicious data, the attacker can trigger a second, unexpected, and user-defined HTTP request to be made to the same server. This can lead to various security issues, such as bypassing security controls, injecting malicious content, or conducting phishing attacks.
How To Fix
Minimum fixed version
8.14.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed versions is not immediately possible, a temporary workaround is to manually sanitize the user-provided Unicode data for the path option of HTTP requests. This can be done by validating and encoding the data to ensure it does not contain any malicious characters or sequences. Here's an example of how to sanitize the path option in Node.js:
const sanitizedPath = encodeURI(userProvidedPath);
Conclusion
The HTTP request splitting vulnerability in Node.js can be mitigated by upgrading to the fixed versions or by manually sanitizing user-provided Unicode data for the path option of HTTP requests. It is important to apply these fixes to prevent potential security risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
This vulnerability allows an attacker to manipulate HTTP requests and potentially bypass security controls, inject malicious content, or conduct phishing attacks.
All versions of Node.js prior to 6.15.0 and 8.14.0 are affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fixes to mitigate any potential risks.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
For more information about this vulnerability, you can refer to the official CVE entry at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
