CVE-2020-8287
published 2021-01-06CVE-2020-8287: Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header…
PriorityP343medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
16.30%
96.6th percentile
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | http-parser | < http-parser 2.9.4-5 (bookworm) | http-parser 2.9.4-5 (bookworm) |
| debian | nodejs | < http-parser 2.9.4-5 (bookworm) | http-parser 2.9.4-5 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| nodejs | node | >= 10.0 < 10.23.1 | 10.23.1 |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.20.1 | 12.20.1 |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.15.4 | 14.15.4 |
| nodejs | node | >= 15.0 < 15.5.1 | 15.5.1 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | >= 10.0.0 < 10.23.1 | 10.23.1 |
| nodejs | node.js | >= 12.0.0 < 12.20.1 | 12.20.1 |
| nodejs | node.js | >= 14.0.0 < 14.15.4 | 14.15.4 |
| nodejs | node.js | >= 15.0.0 < 15.5.1 | 15.5.1 |
| nodejs | nodejs | >= 0 < 12.20.1~dfsg-1 | 12.20.1~dfsg-1 |
| nodejs | nodejs | >= 0 < 12.20.1~dfsg-1 | 12.20.1~dfsg-1 |
| nodejs | nodejs | >= 0 < 12.20.1~dfsg-1 | 12.20.1~dfsg-1 |
| nodejs | nodejs | >= 0 < 12.20.1~dfsg-1 | 12.20.1~dfsg-1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Node.js vulnerabilities
vendor_ubuntu·2023-09-19·CVSS 7.5
CVE-2019-15604 [HIGH] Node.js vulnerabilities
Title: Node.js vulnerabilities
Summary: Several security issues were fixed in Node.js.
Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-15604)
Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-15605)
Alyssa Wilk discovered that Node.js incorrectly handled
CISA ICS
Hitachi Energy FACTS Control Platform (FCP) Product
cisa_ics·2022-08-30·CVSS 3.7
[LOW] Hitachi Energy FACTS Control Platform (FCP) Product
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Hitachi Energy FACTS Control Platform (FCP) Product
Last RevisedAugust 30, 2022
Alert CodeICSA-22-242-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: FACTS Control Platform (FCP) Product
- Vulnerability: Inconsistent Interpretation of HTTP Requests, Use After Free, Classic Buffer Overflow, Integer Underflow, Improper Certificate Validation, Observable Discrepancy.
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow an attacker to eavesdrop on the traffic betw
CISA ICS
Hitachi Energy Gateway Station (GWS) Product
cisa_ics·2022-08-30·CVSS 3.7
[LOW] Hitachi Energy Gateway Station (GWS) Product
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Hitachi Energy Gateway Station (GWS) Product
Last RevisedAugust 30, 2022
Alert CodeICSA-22-242-02
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: Gateway Station (GWS) Product
- Vulnerability: Inconsistent Interpretation of HTTP Requests, Use After Free, Classic Buffer Overflow, Integer Underflow, Improper Certificate Validation, Observable Discrepancy
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow unauthorized users to eavesdrop on the traffic between netwo
Ubuntu
http-parser vulnerability
vendor_ubuntu·2022-08-10
CVE-2020-8287 http-parser vulnerability
Title: http-parser vulnerability
Summary: http-parser could be made to expose sensitive data if it received
a specially crafted request.
It was discovered that http-parser incorrectly handled certain requests.
An attacker could possibly use this issue to bypass security controls or
gain unauthorized access to sensitive data.
Instructions: In general, a standard system update will make all the necessary changes.
CISA ICS
Hitachi Energy MicroSCADA Pro/X SYS600
cisa_ics·2022-04-21
Hitachi Energy MicroSCADA Pro/X SYS600
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Hitachi Energy MicroSCADA Pro/X SYS600
Last RevisedApril 21, 2022
Alert CodeICSA-22-111-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: MicroSCADA Pro/X SYS600
- Vulnerabilities: Observable Discrepancy, HTTP Request Smuggling, Classic Buffer Overflow, Improper Certificate Validation, Improper Restriction of Operations within the Bounds of a Memory Buffer, Exposure of Sensitive Information to an Unauthorized Actor
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities coul
CISA ICS
Siemens SINEC INS
cisa_ics·2022-03-10·CVSS 5.9
[MEDIUM] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedMarch 10, 2022
Alert CodeICSA-22-069-09
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerability: Using Components with Known Vulnerabilities
## 2. RISK EVALUATION
Successful exploitation of this vulnerability in third-party components could allow an attacker to interfere with the affected product in various ways.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Siemens reports this vulnerability affects the following SINEC INS (Infrastructure Netw
Red Hat
nodejs: HTTP request smuggling via two copies of a header field in an http request
vendor_redhat·2021-01-04·CVSS 6.5
CVE-2020-8287 [MEDIUM] CWE-444 nodejs: HTTP request smuggling via two copies of a header field in an http request
nodejs: HTTP request smuggling via two copies of a header field in an http request
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity.
Package: nodejs (Red Hat Enterprise Linux 9) - Not affected
Package: quay (Red Hat Quay 3) - Not affected
Debian
CVE-2020-8287: http-parser - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a ...
vendor_debian·2020·CVSS 6.5
CVE-2020-8287 [MEDIUM] CVE-2020-8287: http-parser - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a ...
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
Scope: local
bookworm: resolved (fixed in 2.9.4-5)
bullseye: resolved (fixed in 2.9.4-4+deb11u1)
forky: resolved (fixed in 2.9.4-5)
sid: resolved (fixed in 2.9.4-5)
trixie: resolved (fixed in 2.9.4-5)
OSV
nodejs vulnerabilities
osv·2023-09-19·CVSS 7.5
CVE-2019-15604 [HIGH] nodejs vulnerabilities
nodejs vulnerabilities
Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-15604)
Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-15605)
Alyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked in
GHSA
GHSA-f33f-hhx9-6j4m: Node
ghsa_unreviewed·2022-05-24
CVE-2020-8287 [MEDIUM] CWE-444 GHSA-f33f-hhx9-6j4m: Node
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
OSV
CVE-2020-8287: Node
osv·2021-01-06·CVSS 6.5
CVE-2020-8287 [MEDIUM] CVE-2020-8287: Node
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CAPEC
HTTP Request Smuggling
mitre_capec
[HIGH] HTTP Request Smuggling
CAPEC-33: HTTP Request Smuggling
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server). See CanPrecede relationships for possible consequences.
Alternate Terms: HTTP Desync
Execution Flow:
Step 1 [Explore]: [Survey network to identify target] The adversary performs network reconnaissance by monitoring relevant traffic to identify the network path and parsing
CWE
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
mitre_cwe
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
(such as a proxy or firewall) in the data flow between two
entities such as a client and server, but it does not
interpret malformed HTTP requests or responses in ways that
are consistent with how the messages will be processed by
those entities that are at the ultimate destination.
HTTP requests or responses ("messages") can be
malformed or unexpected in ways that cause web servers or
clients to interpret the messages in different ways than
intermediary HTTP agents such as load balancers, reverse
proxies, web caching proxies, application firewalls,
etc. For example, an adversary may be able to add duplicate
or different header fields that a client or s
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://hackerone.com/reports/1002188https://lists.debian.org/debian-lts-announce/2022/12/msg00009.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/https://security.gentoo.org/glsa/202101-07https://security.netapp.com/advisory/ntap-20210212-0003/https://www.debian.org/security/2021/dsa-4826https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://hackerone.com/reports/1002188https://lists.debian.org/debian-lts-announce/2022/12/msg00009.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/https://security.gentoo.org/glsa/202101-07https://security.netapp.com/advisory/ntap-20210212-0003/https://www.debian.org/security/2021/dsa-4826https://www.oracle.com/security-alerts/cpujan2021.html
2021-01-06
Published