HTTP Request Smuggling Vulnerability in Node.js Package - CVE-2022-32213
Summary
UBUNTU-CVE-2022-32213: The llhttp parser. Affects nodejs versions < 12.22.9~dfsg-1ubuntu3.2. Fixed in 12.22.9~dfsg-1ubuntu3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The package in question, nodejs, is essential for running JavaScript applications and includes various modules, including the http module. This module is responsible for handling HTTP requests and responses. However, a vulnerability in the llhttp parser within this module has been identified, which can lead to serious security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2022-32213, originates from the llhttp parser used in Node.js versions prior to v14.20.1, v16.17.1, and v18.9.1. It fails to correctly parse and validate Transfer-Encoding headers, which can lead to HTTP Request Smuggling (HRS). This type of attack allows an attacker to manipulate the way requests are processed by the server, potentially leading to unauthorized access, data leakage, or other malicious activities. The severity of this vulnerability is rated with a CVSS score of 6.5, indicating a medium level of risk.
How To Fix
Minimum fixed version
12.22.9~dfsg-1ubuntu3.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional security measures such as using a web application firewall (WAF) to help filter and monitor HTTP requests, thereby reducing the risk of HTTP Request Smuggling attacks.
Conclusion
In summary, CVE-2022-32213 is a significant vulnerability in the Node.js http module that can lead to HTTP Request Smuggling attacks. It is crucial for users to update their nodejs package to the patched version to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
CVE-2022-32213 is a vulnerability in the llhttp parser of the Node.js http module that allows for HTTP Request Smuggling due to improper parsing of Transfer-Encoding headers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized access, data leakage, and the ability for attackers to manipulate server request processing.
Yes, a patched version of the nodejs package is available. It is recommended to update to version 12.22.9~dfsg-1ubuntu3.2 or later.
Vulert is a monitoring tool that uses a manifest file like package-lock.json to track and alert users in real-time about open-source vulnerabilities in their software.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
