CVE-2022-32215

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers a rich library of various JavaScript modules and is widely used in server-side applications.

‍

An HTTP Request Smuggling vulnerability has been identified in Node. The issue stems from the llhttp parser not correctly handling multi-line Transfer-Encoding headers. This weakness allows attackers to perform HTTP Request Smuggling (HRS).

‍

This vulnerability affects specific versions of the package and can result in unauthorized access and data leakage. Details on affected versions and reproduction steps are provided below.

‍

Details

Module Info

• ‍Affected packages: Node‍
• Affected versions: 4.0 < 14.20.1, 16 < 16.17.1, 18 < 18.9.1 ‍
• GitHub repository: https://github.com/nodejs/node‍
• Published packages: https://github.com/nodejs/node/releases‍
• Package manager: npm‍
• Fixed in: Node.js NES version 12
  

‍

Vulnerability Info

The issue stems from improper handling of multi-line Transfer-Encoding headers.

For instance, in a web application, if a malicious actor sends a crafted request with multi-line Transfer-Encoding headers, the system may misinterpret the request, leading to unexpected behavior. This behavior can be exploited by attackers to perform HTTP Request Smuggling.

‍

This vulnerability is a result of flawed logic in the llhttp parser, and may allow attackers to manipulate HTTP requests and responses.

- https://www.cve.org/CVERecord?id=CVE-2022-32215

- https://hackerone.com/reports/1501679

‍

Mitigation

This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.

- Update to a patched LTS version of Node.js

- Leverage a commercial support partner like HeroDevs for post-EOL security.

Refer to the NES documentation for upgrade instructions.

‍

Credits

- zeyu2001