Node.js OS Command Injection Vulnerability - CVE-2022-32212
Summary
UBUNTU-CVE-2022-32212: A OS Command Injection vulnerability exists in Node.js versions. Affects nodejs versions < 8.10.0~dfsg-2ubuntu0.4+esm4. Fixed in 8.10.0~dfsg-2ubuntu0.4+esm4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected versions of Node.js are vulnerable to an OS Command Injection due to insufficient validation in the IsAllowedHost check, which can lead to serious security issues.
Vulnerability Detail
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0. This vulnerability arises from an inadequate IsAllowedHost check that can be easily bypassed because the IsIPAddress function does not properly validate whether an IP address is invalid before making database requests. This flaw allows attackers to perform rebinding attacks, potentially compromising the system's integrity and confidentiality.
How To Fix
Minimum fixed version
8.10.0~dfsg-2ubuntu0.4+esm4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected Node.js services by implementing network-level controls or using firewalls to limit incoming requests to trusted IP addresses only.
Conclusion
CVE-2022-32212 represents a significant security risk for applications using vulnerable versions of Node.js. It is crucial for developers and system administrators to update their Node.js installations to the latest patched versions to mitigate this risk. Implementing network-level controls can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for nodejs →
FAQ
CVE-2022-32212 is a vulnerability in Node.js that allows for OS Command Injection due to insufficient validation of host addresses.
Node.js versions prior to 14.20.0, 16.20.0, and 18.5.0 are affected by this vulnerability.
Exploitation of this vulnerability could allow attackers to execute arbitrary commands on the server, leading to data breaches or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2022-32212 is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
