cbcvebase.
CVE-2013-4450
published 2013-10-21

CVE-2013-4450: The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by…

PriorityP338medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
37.22%
98.4th percentile
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.

Affected

52 ranges· showing 25
VendorProductVersion rangeFixed in
debiannodejs< nodejs 0.10.21~dfsg1-1 (bookworm)nodejs 0.10.21~dfsg1-1 (bookworm)
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs
nodejsnodejs

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/nodejs_pipelining.rb
urlhttps://github.com/joyent/node/commit/085dd30e93da67362f044ad1b3b6b2d997064692
urlhttps://github.com/joyent/node/commit/b97c28f59ee898a81f0df988c249359c9b42701d
urlhttps://github.com/joyent/node/commit/653d4db71f569ddc87a0bc21f5ecc5ceaf37f932
urlhttps://github.com/joyent/node/blob/v0.10.21-release/test/simple/test-http-pipeline-flood.js
  • The attack sends many pipelined HTTP requests on a single TCP connection without reading responses, causing unbounded memory and CPU growth on the Node.js process. Monitor for a single source IP opening one connection and issuing an abnormally large number of pipelined HTTP requests.
  • Vulnerable Node.js versions are 0.10.x before 0.10.21 and 0.8.x before 0.8.26. Identify these versions in your environment as they are exploitable targets.
  • The fix introduced backpressure in the HTTP pipeline handler ('http: provide backpressure for pipeline flood'). Absence of this patch in Node.js 0.10.x/0.8.x source or binaries confirms vulnerability.
  • ·OpenShift Enterprise 1.2 (and its nodejs 0.6.x) will NOT receive a fix as the issue is rated Moderate and the product is past its full-support lifecycle phase.

CVSS provenance

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.