Critical Vulnerability in node-got Package: Redirect to UNIX Socket
Summary
UBUNTU-CVE-2022-33987: The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket. Affects node-got versions 7.1.0-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-got package is a popular HTTP request library for Node.js, designed to simplify the process of making HTTP requests. It provides a user-friendly API and supports various features such as promises and streams. However, a vulnerability has been identified in versions prior to 12.1.0, which allows for potentially dangerous redirects to UNIX sockets, posing a security risk to applications utilizing this package.
Vulnerability Detail
The vulnerability, identified as CVE-2022-33987, originates from the handling of redirects within the node-got package. Specifically, versions before 12.1.0 (and also fixed in 11.8.5) allow an attacker to redirect HTTP requests to a UNIX socket. This could lead to unauthorized access to sensitive data or services running on the local machine, as the application may inadvertently expose internal resources to external entities. The CVSS score for this vulnerability is 5.3, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to implement strict validation of redirect URLs within your application to prevent unauthorized redirects to UNIX sockets. This can be done by checking the URL scheme and ensuring it does not point to a local socket.
Conclusion
The node-got package has a critical vulnerability that allows for unsafe redirects to UNIX sockets, which can compromise application security. It is crucial to update to the latest patched version to mitigate this risk. Users should also consider implementing workarounds if immediate updates are not possible.
See every vulnerability recorded for node-got →
FAQ
CVE-2022-33987 is a vulnerability in the node-got package that allows HTTP requests to be redirected to UNIX sockets, potentially exposing sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of node-got prior to 12.1.0 are vulnerable, as well as 11.x versions before 11.8.5.
If you cannot upgrade immediately, implement strict validation of redirect URLs to mitigate the risk until you can update.
The CVSS score for this vulnerability is 5.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-got.
