Node.js 14.x < 14.20.0 / 16.x < 16.16.0 / 18.x < 18.5.0 Multiple Vulnerabilities (July 7th 2022 Security Releases).

high Nessus Plugin ID 165634

Language:

Synopsis

Node.js - JavaScript run-time environment is affected by multiple vulnerabilities.

Description

The version of Node.js installed on the remote host is prior to 14.20.0, 16.16.0, 18.5.0. It is, therefore, affected by multiple vulnerabilities as referenced in the July 7th 2022 Security Releases advisory.

 - The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2022-32213 after publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts:
 (CVE-2022-32213)

 - The llhttp parser in the http module does not strictly use the CRLF sequence to delimit HTTP requests.
 This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2022-32214 after publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts:
 (CVE-2022-32214)

 - The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2022-32215 after publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts:
 (CVE-2022-32215)

 - The IsAllowedHost check can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), browsers (such as Firefox) will make DNS requests to the DNS server, providing a vector for an attacker- controlled DNS server or a MITM who can spoof DNS responses to perform a rebinding attack and hence connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of CVE-2021-22884. More details will be available at CVE-2022-32212 after publication. Thank you to Axel Chong for reporting this vulnerability. Impacts: (CVE-2022-32212)

 - This vulnerability can be exploited if the victim has the following dependencies on Windows machine:
 Whenever the above conditions are present, node.exe will search for providers.dll in the current user directory. After that, node.exe will try to search for providers.dll by the DLL Search Order in Windows.
 It is possible for an attacker to place the malicious file providers.dll under a variety of paths and exploit this vulnerability. More details will be available at CVE-2022-32223 after publication. Thank you to Yakir Kadkoda from Aqua Security for reporting this vulnerability. Impacts: Note: Node.js can use an OpenSSL configuration file by specifying the environment variable OPENSSL_CONF, or using the command line option --openssl-conf, and if none of those are specified will default to reading the default OpenSSL configuration file openssl.cnf. Node.js will only read a section that is by default named nodejs_conf. If your installation was using the default openssl.cnf file and is affected by this breaking change you can fall back to the previous behavior by: (CVE-2022-32223)

 - When Node.js starts on linux based systems, it attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf, which ordinarily doesn't exist. On some shared systems an attacker may be able create this file and therefore affect the default OpenSSL configuration for other users. Thank you to Michael Scovetta from the OpenSSF Alpha-Omega project for reporting this vulnerability. Impacts: (CVE-2022-32222)

 - AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of in place encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Impacts: (CVE-2022-2097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Node.js version 14.20.0 / 16.16.0 / 18.5.0 or later.

See Also

https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

Plugin Details

Severity: High

ID: 165634

File Name: nodejs_2022_jul.nasl

Version: 1.4

Type: local

Agent: windows, macosx, unix

Family: Misc.

Published: 10/3/2022

Updated: 3/23/2023

Supported Sensors: Nessus Agent

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2022-2097

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

CVSS Score Source: CVE-2022-32212

Vulnerability Information

CPE: cpe:/a:nodejs:node.js

Required KB Items: installed_sw/Node.js

Exploit Ease: No known exploits are available

Patch Publication Date: 7/7/2022

Vulnerability Publication Date: 7/5/2022

Reference Information

CVE: CVE-2022-2097, CVE-2022-32212, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-32222, CVE-2022-32223

IAVB: 2022-B-0036-S