Critical HTTP Desync Vulnerability in Node.js Package
Summary
UBUNTU-CVE-2020-8201: Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. Affects nodejs versions < 12.22.9~dfsg-1ubuntu3. Fixed in 12.22.9~dfsg-1ubuntu3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The specific version affected by this vulnerability is 12.22.9~dfsg-1ubuntu3, which has been identified to have a flaw in processing HTTP header names, making it susceptible to various attacks.
Vulnerability Detail
The vulnerability arises from a bug in the handling of carriage-return symbols in HTTP header names within Node.js versions prior to 12.18.4 and 14.11. This flaw can be exploited to perform HTTP desynchronization attacks, allowing attackers to deliver malicious payloads to unsuspecting users. The potential ramifications include session hijacking, cookie poisoning, and clickjacking, which can compromise user data and system integrity.
How To Fix
Minimum fixed version
12.22.9~dfsg-1ubuntu3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing input validation on HTTP headers to mitigate the risk of exploitation until the package can be updated.
Conclusion
The identified vulnerability in Node.js poses significant risks to applications using the affected version. It is essential to update to the patched version to safeguard against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
Node.js versions prior to 12.18.4 and 14.11 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
This vulnerability can lead to session hijacking, cookie poisoning, and clickjacking, among other attacks.
Yes, implementing input validation on HTTP headers can help mitigate the risk until the package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
