Hostname Spoofing Vulnerability in Node.js Package
Summary
UBUNTU-CVE-2018-12123: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostna... Affects nodejs versions 0.10.15~dfsg1-4 – 0.10.25~dfsg2-2ubuntu1.2+esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The Node.js package is essential for running JavaScript applications outside of a browser, providing a rich library of modules and a robust ecosystem. However, certain versions of Node.js are vulnerable to a hostname spoofing issue that can lead to security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the URL parser in Node.js, which allows for hostname spoofing when using the 'javascript:' protocol. If an application utilizes url.parse() to determine the hostname, it can be manipulated by using a mixed-case 'javascript:' protocol (e.g., 'javAscript:'). This can lead to incorrect security decisions based on the hostname, potentially exposing applications to security threats.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the 'javascript:' protocol in your applications until the package is updated. Additionally, implement strict validation of URLs before making security decisions based on the hostname.
Conclusion
The hostname spoofing vulnerability in Node.js poses significant risks to applications that rely on the URL parser for security decisions. It is essential to update to the patched versions of Node.js to mitigate these risks. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a medium level of severity.
All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0, and 11.3.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The potential risks include incorrect security decisions based on spoofed hostnames, which could lead to unauthorized access or data breaches.
Yes, as a temporary measure, avoid using the 'javascript:' protocol and validate URLs strictly before making security decisions.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
