UNIX Socket Redirection Vulnerability in node-got Package
Summary
CVE-2022-33987: The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket. Affects node-got across 2 version ranges.
< 5e17bb748c260b02e4cf716c2f4079a1c6a7481e
< 11.8.1+~cs53.13.17-3+deb11u1
Fixed in 11.8.1+~cs53.13.17-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-got package is a popular HTTP request library for Node.js, designed to simplify making HTTP requests and handling responses. It provides a user-friendly API and supports various features like retries, streams, and hooks. However, prior to version 12.1.0, the package was susceptible to a vulnerability that allowed attackers to redirect requests to UNIX sockets, potentially leading to unauthorized access or data leakage.
Vulnerability Detail
The vulnerability, identified as CVE-2022-33987, arises from improper handling of redirects within the node-got package. This flaw allows an attacker to manipulate the request flow, redirecting it to a UNIX socket instead of the intended HTTP endpoint. This could result in sensitive data being exposed or unauthorized access to local services. The vulnerability affects multiple versions of the package across different Debian ecosystems, with a CVSS score of 5.3 indicating a moderate severity level.
How To Fix
Minimum fixed version
11.8.1+~cs53.13.17-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-gotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing network-level controls to restrict access to UNIX sockets from untrusted sources. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The node-got package has a vulnerability (CVE-2022-33987) that allows for unauthorized redirection to UNIX sockets. It is crucial to update the package to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for node-got →
FAQ
CVE-2022-33987 is a vulnerability in the node-got package that allows attackers to redirect requests to UNIX sockets, potentially leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2022-33987 is 5.3, indicating a moderate severity level.
If you cannot update the package, implement network-level controls to restrict access to UNIX sockets from untrusted sources as a temporary workaround.
More information about the node-got package can be found on its GitHub repository at https://github.com/sindresorhus/got.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-got.
