CVE-2022-32212
published 2022-07-14CVE-2022-32212: A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be…
PriorityP353high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
6.43%
93.7th percentile
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | nodejs | < nodejs 18.6.0+dfsg-3 (bookworm) | nodejs 18.6.0+dfsg-3 (bookworm) |
| debian | nodejs | < nodejs 18.12.1+dfsg-1 (bookworm) | nodejs 18.12.1+dfsg-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_nodejs_16.20.2-4_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_nodejs_14.20.0-1_on_cbl_mariner_1.0 | — | — |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.21.1 | 14.21.1 |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.18.1 | 16.18.1 |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.12.1 | 18.12.1 |
| nodejs | node | >= 19.0 < 19.0.1 | 19.0.1 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.1HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_oracle8.1HIGH
vendor_redhat8.1HIGH
vendor_ubuntu8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Node.js vulnerabilities
vendor_ubuntu·2023-11-21·CVSS 8.1
CVE-2022-32213 [HIGH] Node.js vulnerabilities
Title: Node.js vulnerabilities
Summary: Several security issues were fixed in Node.js.
Axel Chong discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-32212)
Zeyu Zhang discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-32213,
CVE-2022-32214, CVE-2022-32215)
It was discovered that Node.js incorrectly handled certain inputs. If a user
or an automated system were tricked into opening
CISA ICS
Siemens SINEC INS
cisa_ics·2023-01-17·CVSS 7.3
[HIGH] Siemens SINEC INS
ICS Advisory
##
Siemens SINEC INS
Last RevisedJanuary 17, 2023
Alert CodeICSA-23-017-03
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.9
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerabilities: OS Command Injection, Inadequate Encryption Strength, Out-of-bounds Write, HTTP Request Smuggling, Inadequate Encryption Strength, Use of Insufficiently Random Values, Authentication Bypass by Spoofing, Path Trave
Oracle
Oracle Oracle Communications Applications Risk Matrix: User Interface (Node.js) — CVE-2022-32212
vendor_oracle·2023-01-15·CVSS 8.1
CVE-2022-32212 [HIGH] Oracle Oracle Communications Applications Risk Matrix: User Interface (Node.js) — CVE-2022-32212
Oracle Oracle Communications Applications Risk Matrix: User Interface (Node.js) vulnerability
CVE: CVE-2022-32212
CVSS: 8.1
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2023 (JAN 2023)
Red Hat
nodejs: DNS rebinding in inspect via invalid octal IP address
vendor_redhat·2022-11-04·CVSS 8.1
CVE-2022-43548 [HIGH] CWE-350 nodejs: DNS rebinding in inspect via invalid octal IP address
nodejs: DNS rebinding in inspect via invalid octal IP address
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.
Statement: Redhat has marked this vulnerabil
Microsoft
A OS Command Injection vulnerability exists in Node.js versions <14.20.0 <16.20.0 <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly c
vendor_msrc·2022-07-12·CVSS 8.1
CVE-2022-32212 [HIGH] CWE-78 A OS Command Injection vulnerability exists in Node.js versions <14.20.0 <16.20.0 <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly c
A OS Command Injection vulnerability exists in Node.js versions Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: htt
Red Hat
nodejs: DNS rebinding in --inspect via invalid IP addresses
vendor_redhat·2022-07-08·CVSS 7.5
CVE-2022-32212 [HIGH] CWE-703 nodejs: DNS rebinding in --inspect via invalid IP addresses
nodejs: DNS rebinding in --inspect via invalid IP addresses
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
A vulnerability was found in NodeJS, where the IsAllowedHost check can be easily bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance, 10.0.2.555 is provided), browsers (such as Firefox) will make DNS requests to the DNS server. This issue provides a vector for an attacker-controlled DNS server or a Man-in-the-middle attack (MITM) who can spoof DNS respon
Debian
CVE-2022-32212: nodejs - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20...
vendor_debian·2022·CVSS 8.1
CVE-2022-32212 [HIGH] CVE-2022-32212: nodejs - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20...
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
Scope: local
bookworm: resolved (fixed in 18.6.0+dfsg-3)
bullseye: resolved (fixed in 12.22.12~dfsg-1~deb11u3)
forky: resolved (fixed in 18.6.0+dfsg-3)
sid: resolved (fixed in 18.6.0+dfsg-3)
trixie: resolved (fixed in 18.6.0+dfsg-3)
Debian
CVE-2022-43548: nodejs - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18...
vendor_debian·2022·CVSS 8.1
CVE-2022-43548 [HIGH] CVE-2022-43548: nodejs - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18...
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
Scope: local
bookworm: resolved (fixed in 18.12.1+dfsg-1)
bullseye: resolved (fixed in 12.22.12~dfsg-1~deb11u3)
forky: resolved (fixed in 18.12.1+dfsg-1)
sid: resolved (fixed in 18.12.1+dfsg-1)
trixie: resolved (fixed in 18.12.1+dfsg-1)
OSV
nodejs vulnerabilities
osv·2023-11-21·CVSS 8.1
CVE-2022-32212 [HIGH] nodejs vulnerabilities
nodejs vulnerabilities
Axel Chong discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-32212)
Zeyu Zhang discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-32213,
CVE-2022-32214, CVE-2022-32215)
It was discovered that Node.js incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly
GHSA
GHSA-r934-m2c7-26gh: A OS Command Injection vulnerability exists in Node
ghsa_unreviewed·2022-12-06·CVSS 8.1
CVE-2022-43548 [HIGH] CWE-78 GHSA-r934-m2c7-26gh: A OS Command Injection vulnerability exists in Node
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
OSV
CVE-2022-43548: A OS Command Injection vulnerability exists in Node
osv·2022-12-05·CVSS 8.1
CVE-2022-43548 [HIGH] CVE-2022-43548: A OS Command Injection vulnerability exists in Node
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
GHSA
GHSA-w95h-2gj2-x2p4: A OS Command Injection vulnerability exists in Node
ghsa_unreviewed·2022-07-15
CVE-2022-32212 [HIGH] CWE-78 GHSA-w95h-2gj2-x2p4: A OS Command Injection vulnerability exists in Node
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
OSV
CVE-2022-32212: A OS Command Injection vulnerability exists in Node
osv·2022-07-14·CVSS 8.1
CVE-2022-32212 [HIGH] CVE-2022-32212: A OS Command Injection vulnerability exists in Node
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
No detection rules found.
No public exploits indexed.
HackerOne
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
hackerone·2023-01-12·CVSS 8.8
CVE-2022-32212 [HIGH] DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
The fix for CVE-2022-32212, covered the cases for routable IP addresses, however, there exists a specific behavior on macOS devices when handling the `http://0.0.0.0` URL that allows an attacker-controlled DNS server to bypass the DNS rebinding protection by resolving hosts in the `.local` domain.
[Original HackerOne report](https://hackerone.com/reports/1632921)
[Node.js Blog](https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#dns-rebinding-in-inspect-insufficient-fix-of-cve-2022-32212-affecting-macos-devices-high-cve-2022-32212-cve-2018-7160)
## Impact
Attacker with access to a compromised DNS server or the ability to spoof its responses can gain access to the Node.js debu
HackerOne
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
hackerone·2022-09-28·CVSS 8.8
CVE-2022-32212 [HIGH] DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
**Summary:** This is an insufficient fix of CVE-2022-32212, which itself is a fix of CVE-2018-7160. There exists a specific behaviour in browsers on macOS devices when handling the `http://0.0.0.0`URL that allows an attacker-controlled DNS server to bypass the DNS rebinding protection by resolving hosts in the `.local` domain.
**Description:**
In the latest version, only IP addresses and `localhost` are allowed in the `Host` header when connecting to the debugger endpoint. `IsIPAddress` ensures that IPv4 address octets only contain values ranging from 0 to 255, but this allows `0.0.0.0` [which indicates an invalid or unroutable target](https://en.wikipedia.org/wiki/0.0.0.0).
In macOS devices, using
2022-07-14
Published