Node.js Vulnerability: Arbitrary SAN Type Acceptance Leading to Potential Security Bypass
Summary
UBUNTU-CVE-2021-44531: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Affects nodejs versions < 12.22.9~dfsg-1ubuntu3.6. Fixed in 12.22.9~dfsg-1ubuntu3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. It is widely used for server-side development due to its non-blocking, event-driven architecture. However, certain versions of Node.js are vulnerable to a security issue that allows arbitrary Subject Alternative Name (SAN) types, which can lead to bypassing name-constrained intermediates in a Public Key Infrastructure (PKI). This vulnerability affects various versions of Node.js, specifically those prior to the patched versions.
Vulnerability Detail
The vulnerability arises from Node.js accepting arbitrary SAN types unless a specific PKI is defined to use a particular SAN type. This can lead to security risks, as it allows URI SAN types that are often not defined in PKIs. Furthermore, Node.js did not match the URI correctly when a protocol permits URI SANs. The affected versions include Node.js versions below 12.22.9, 14.18.3, 16.13.2, and 17.3.1. The ramifications include potential security breaches where attackers could exploit this flaw to bypass security checks.
How To Fix
Minimum fixed version
12.22.9~dfsg-1ubuntu3.6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to use the --security-revert command-line option when running Node.js. This option disables the URI SAN type when checking a certificate against a hostname, thus mitigating the risk until an update can be applied.
Conclusion
In summary, the Node.js vulnerability related to arbitrary SAN type acceptance poses significant security risks. It is crucial to update to the patched versions to mitigate these risks effectively. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities in your applications.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
Node.js versions below 12.22.9, 14.18.3, 16.13.2, and 17.3.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential risks include unauthorized access and security breaches due to the ability to bypass name-constrained intermediates in a PKI.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
