CVE-2018-7160
published 2018-05-17CVE-2018-7160: The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is…
PriorityP355high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
9.92%
95.1th percentile
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
Affected
49 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 8.11.1~dfsg-2 (bookworm) | nodejs 8.11.1~dfsg-2 (bookworm) |
| debian | nodejs | < nodejs 12.21.0~dfsg-1 (bookworm) | nodejs 12.21.0~dfsg-1 (bookworm) |
| f5 | big-ip_access_policy_manager_client | — | — |
| f5 | big-ip_apm | — | — |
| f5 | big-ip_edge_client | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| nodejs | node | >= 10.0 < 10.24.0 | 10.24.0 |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.21.0 | 12.21.0 |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.16.0 | 14.16.0 |
| nodejs | node | >= 15.0 < 15.10.0 | 15.10.0 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | >= 10.0.0 < 10.24.0 | 10.24.0 |
| nodejs | node.js | >= 12.0.0 < 12.21.0 | 12.21.0 |
| nodejs | node.js | >= 14.0.0 < 14.16.0 | 14.16.0 |
| nodejs | node.js | >= 15.0.0 < 15.10.0 | 15.10.0 |
| nodejs | node.js | 6.0.0 – 6.8.1 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Node.js bad
ghsa_unreviewed·2022-05-24·CVSS 8.8
CVE-2021-22884 [HIGH] CWE-506 Node.js bad
Node.js bad
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
GHSA
Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding
ghsa·2022-05-13
CVE-2018-7160 [HIGH] CWE-290 Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding
Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding
## Withdrawn Advisory
This advisory has been withdrawn because this vulnerability affects inspector code in https://github.com/nodejs/node, not the [legacy debugger](https://nodejs.org/en/docs/inspector#legacy-debugger) at https://github.com/node-inspector/node-inspector. https://github.com/nodejs/node is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems).
## Original Description
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer runn
OSV
nodejs vulnerabilities
osv·2021-03-15·CVSS 5.9
CVE-2016-7099 [MEDIUM] nodejs vulnerabilities
nodejs vulnerabilities
Alexander Minozhenko and James Bunton discovered that Node.js did not
properly handle wildcards in name fields of X.509 TLS certificates. An
attacker could use this vulnerability to execute a machine-in-the-middle-
attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)
It was discovered that Node.js incorrectly handled certain NAPTR responses.
A remote attacker could possibly use this issue to cause applications using
Node.js to crash, resulting in a denial of service. This issue only affected
Ubuntu 16.04 ESM. (CVE-2017-1000381)
Nikita Skovoroda discovered that Node.js mishandled certain input, leading
to an out of bounds write. An attacker could use this vulnerability to
cause a denial of service (crash) or possibly execute arbitrary co
OSV
CVE-2021-22884: Node
osv·2021-03-03·CVSS 8.8
CVE-2021-22884 [HIGH] CVE-2021-22884: Node
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
OSV
CVE-2018-7160: The Node
osv·2018-05-17·CVSS 8.8
CVE-2018-7160 [HIGH] CVE-2018-7160: The Node
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
OSV
webkit2gtk vulnerabilities
osv·2018-01-30·CVSS 8.8
CVE-2018-4088 webkit2gtk vulnerabilities
webkit2gtk vulnerabilities
Multiple security issues were discovered in the WebKitGTK+ Web and
JavaScript engines. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit these to cause a
denial of service, spoof the user interface, or execute arbitrary code.
(CVE-2018-4088, CVE-2018-4096, CVE-2017-7153, CVE-2017-7160,
CVE-2017-7161, CVE-2017-7165, CVE-2017-13884, CVE-2017-13885)
Ubuntu
Node.js vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 5.9
CVE-2018-7160 [MEDIUM] Node.js vulnerabilities
Title: Node.js vulnerabilities
Summary: Several security issues were fixed in Node.js.
Alexander Minozhenko and James Bunton discovered that Node.js did not
properly handle wildcards in name fields of X.509 TLS certificates. An
attacker could use this vulnerability to execute a machine-in-the-middle-
attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)
It was discovered that Node.js incorrectly handled certain NAPTR responses.
A remote attacker could possibly use this issue to cause applications using
Node.js to crash, resulting in a denial of service. This issue only affected
Ubuntu 16.04 ESM. (CVE-2017-1000381)
Nikita Skovoroda discovered that Node.js mishandled certain input, leading
to an out of bounds write. An attacker could use this vulnerability to
c
Red Hat
nodejs: DNS rebinding in --inspect
vendor_redhat·2021-02-18·CVSS 8.8
CVE-2021-22884 [HIGH] CWE-20 nodejs: DNS rebinding in --inspect
nodejs: DNS rebinding in --inspect
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
A flaw was found in nodejs. A denial of service is possible when the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS over the network. If the attack
Debian
CVE-2021-22884: nodejs - Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebin...
vendor_debian·2021·CVSS 8.8
CVE-2021-22884 [HIGH] CVE-2021-22884: nodejs - Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebin...
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
Scope: local
bookworm: resolved (fixed in 12.21.0~dfsg-1)
bullseye: resolved (fixed in 12.21.0~dfsg-1)
forky: resolved (fixed in 12.21.0~dfsg-1)
sid: resolved (fixed in 12.21.0~dfsg-1)
trixie: resolved (fixed in 12.21.0~dfsg-1)
F5
CVE-2018-15316: In F5 BIG-IP APM 13
vendor_f5·2018-10-19·CVSS 5.5
CVE-2018-15316 [MEDIUM] CVE-2018-15316: In F5 BIG-IP APM 13
CVE-2018-15316: In F5 BIG-IP APM 13
In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the policy library with user permission and bypassing the endpoint checks.
Affected Products: BIG-IP APM, Big-Ip Access Policy Manager Client, Big-Ip Edge Client
Affected Versions: 13.0.0 - 13.1.1.1; 7.1.5 - 7.1.6; 7101 - 7160
F5 Advisory Articles: K51220077
F5 References: https://support.f5.com/csp/article/K51220077
Red Hat
nodejs: Inspector DNS rebinding vulnerability
vendor_redhat·2018-03-08·CVSS 8.8
CVE-2018-7160 [HIGH] CWE-20 nodejs: Inspector DNS rebinding vulnerability
nodejs: Inspector DNS rebinding vulnerability
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
It was found that when a Node.js script is run
Debian
CVE-2018-7160: nodejs - The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack ...
vendor_debian·2018·CVSS 8.8
CVE-2018-7160 [HIGH] CVE-2018-7160: nodejs - The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack ...
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
Scope: local
bookworm: resolved (fixed in 8.11.1~dfsg-2)
bullseye: resolved (fixed in 8.11.1~df
No detection rules found.
No public exploits indexed.
HackerOne
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
hackerone·2023-01-12·CVSS 8.8
CVE-2022-32212 [HIGH] DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
The fix for CVE-2022-32212, covered the cases for routable IP addresses, however, there exists a specific behavior on macOS devices when handling the `http://0.0.0.0` URL that allows an attacker-controlled DNS server to bypass the DNS rebinding protection by resolving hosts in the `.local` domain.
[Original HackerOne report](https://hackerone.com/reports/1632921)
[Node.js Blog](https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#dns-rebinding-in-inspect-insufficient-fix-of-cve-2022-32212-affecting-macos-devices-high-cve-2022-32212-cve-2018-7160)
## Impact
Attacker with access to a compromised DNS server or the ability to spoof its responses can gain access to the Node.js debu
HackerOne
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
hackerone·2022-09-28·CVSS 8.8
CVE-2022-32212 [HIGH] DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
**Summary:** This is an insufficient fix of CVE-2022-32212, which itself is a fix of CVE-2018-7160. There exists a specific behaviour in browsers on macOS devices when handling the `http://0.0.0.0`URL that allows an attacker-controlled DNS server to bypass the DNS rebinding protection by resolving hosts in the `.local` domain.
**Description:**
In the latest version, only IP addresses and `localhost` are allowed in the `Host` header when connecting to the debugger endpoint. `IsIPAddress` ensures that IPv4 address octets only contain values ranging from 0 to 255, but this allows `0.0.0.0` [which indicates an invalid or unroutable target](https://en.wikipedia.org/wiki/0.0.0.0).
In macOS devices, using
HackerOne
DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)
hackerone·2021-02-23·CVSS 8.8
CVE-2018-7160 [HIGH] DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)
DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)
**Summary:** While the debugger (i.e., the --inspect option) tries to prevent DNS rebinding, the whitelist is excessive.
**Description:** The whitelist includes “localhost6”, which is not that widespread. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
Reasoning why localhost6 is not so common and Node.js should not rely on its presence in the hosts file:
* It is not even present in the n
Bugzilla
CVE-2018-7160 nodejs: Inspector DNS rebinding vulnerability
bugzilla·2018-03-29·CVSS 8.8
CVE-2018-7160 [HIGH] CVE-2018-7160 nodejs: Inspector DNS rebinding vulnerability
CVE-2018-7160 nodejs: Inspector DNS rebinding vulnerability
A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access.
References:
https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md
Discussion:
Created nodejs tracking bugs for this issue:
Affects: fedora-all [bug 1562027]
Affects: epel-all [bug 1562026]
---
rh-nodejs4-nodejs is not affected since NodeJS 4 has no support for the inspector.
---
NodeJS is only packaged as an ImageStream in Openshift Enterprise 3.9, which is a container image from RH Software Collections. Marking Openshift
Bugzilla
CVE-2018-7158 CVE-2018-7159 CVE-2018-7160 nodejs: various flaws [fedora-all]
bugzilla·2018-03-29·CVSS 7.5
CVE-2018-7158 [HIGH] CVE-2018-7158 CVE-2018-7159 CVE-2018-7160 nodejs: various flaws [fedora-all]
CVE-2018-7158 CVE-2018-7159 CVE-2018-7160 nodejs: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2018-7158 CVE-2018-7159 CVE-2018-7160 nodejs: various flaws [epel-all]
bugzilla·2018-03-29·CVSS 7.5
CVE-2018-7158 [HIGH] CVE-2018-7158 CVE-2018-7159 CVE-2018-7160 nodejs: various flaws [epel-all]
CVE-2018-7158 CVE-2018-7159 CVE-2018-7160 nodejs: various flaws [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of F
https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/https://support.f5.com/csp/article/K63025104?utm_source=f5support&%3Butm_medium=RSShttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://nodejs.org/en/blog/vulnerability/march-2018-security-releases/https://support.f5.com/csp/article/K63025104?utm_source=f5support&%3Butm_medium=RSShttps://www.oracle.com//security-alerts/cpujul2021.html
2018-05-17
Published