Authorization Bypass Vulnerability in Node.js Packages
Summary
UBUNTU-CVE-2019-15606: Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons. Affects nodejs versions 0.10.15~dfsg1-4 – 0.10.25~dfsg2-2ubuntu1.2+esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. The affected packages, including nodejs, nodejs-dev, and nodejs-legacy, are essential for running JavaScript on the server side. This vulnerability affects specific versions of Node.js, leading to potential security risks in applications relying on these packages.
Vulnerability Detail
The vulnerability arises from the inclusion of trailing white space in HTTP header values, which can lead to an authorization bypass during header value comparisons. This issue affects Node.js versions 10, 12, and 13, allowing unauthorized access to resources that should be protected based on header values. The potential ramifications include unauthorized data exposure and manipulation, making it critical for developers to address this vulnerability promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your application does not rely on header value comparisons that could be affected by trailing white spaces. Implement input validation to sanitize header values before processing them.
Conclusion
In summary, the authorization bypass vulnerability in Node.js packages poses significant security risks. It is crucial for developers to update their packages to the patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
The vulnerability affects Node.js versions 10, 12, and 13.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The potential risks include unauthorized access to sensitive data and manipulation of resources that should be protected.
Yes, patched versions of the affected Node.js packages are available. It is recommended to update to the latest versions as specified in the 'how to fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
