Recently, Node.js released an advisory to fix seven vulnerabilities including three separate HTTP Request Smuggling, one code execution (CVE-2022-32212), and other flaws.
Rated as high severity, CVE-2022-32212 impacts all versions of the 18.x, 16.x, and 14.x releases lines. This bug was reported by Axel Chong. “The IsAllowedHost check can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), browsers (such as Firefox) will make DNS requests to the DNS server, providing a vector for an attacker-controlled DNS server or a MITM who can spoof DNS responses to perform a rebinding attack and hence connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of CVE-2021-22884,” read the advisory.
Three HTTP request smuggling flaws include:
- CVE-2022-32215: Incorrect parsing of multi-line transfer-encoding
- CVE-2022-32213: Flawed parsing of transfer-encoding
- CVE-2022-32214: Improper delimiting of header fields
The advisory also details a DLL Hijacking vulnerability on Windows (CVE-2022-32223), and CVE-2022-32222 could allow an attacker to attempt to read openssl.cnf from /home/iojs/build/ upon system startup.
The last bug that was fixed in these releases is CVE-2022-2097. It could cause encryption to fail in some circumstances. AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn’t written. In the special case of “in place” encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB-based cipher suites for TLS and DTLS, they are both unaffected.
All of the vulnerabilities have been fixed in Node.js v14.20.0 (LTS), Node.js v16.16.0 (LTS), and Node.js v18.5.0 (Current).
