Overview
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers a rich library of various JavaScript modules and is widely used in server-side applications.
An HTTP Request Smuggling vulnerability has been identified in Node. The issue stems from the llhttp parser not correctly handling multi-line Transfer-Encoding headers. This weakness allows attackers to perform HTTP Request Smuggling (HRS).
This vulnerability affects specific versions of the package and can result in unauthorized access and data leakage. Details on affected versions and reproduction steps are provided below.
Details
Module Info
Affected packages: Node
Affected versions: 4.0 < 14.20.1, 16 < 16.17.1, 18 < 18.9.1
GitHub repository: https://github.com/nodejs/node
Published packages: https://github.com/nodejs/node/releases
Package manager: npm
Fixed in: Node.js NES version 12
Vulnerability Info
The issue stems from improper handling of multi-line Transfer-Encoding headers.
For instance, in a web application, if a malicious actor sends a crafted request with multi-line Transfer-Encoding headers, the system may misinterpret the request, leading to unexpected behavior. This behavior can be exploited by attackers to perform HTTP Request Smuggling.
This vulnerability is a result of flawed logic in the llhttp parser, and may allow attackers to manipulate HTTP requests and responses.
- https://www.cve.org/CVERecord?id=CVE-2022-32215
- https://hackerone.com/reports/1501679
Credits
- zeyu2001
Mitigation
This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.
- Update to a patched LTS version of Node.js
- Leverage a commercial support partner like HeroDevs for post-EOL security.
Refer to the NES documentation for upgrade instructions.
