CVE-2022-32212 — Improper Access Control in Node

CWE-284 — Improper Access ControlCWE-78 — OS Command InjectionCWE-703 — Improper Check or Handling of Exceptional ConditionsCWE-350 — Reliance on Reverse DNS Resolution for a Security-Critical Action13 documents10 sources
Severity
8.1HIGHNVD
EPSS
0.1%
top 80.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Nodejs NodeNodejsNodejs Node.js+3 more
Timeline
PublishedJul 14
Latest updateNov 21

Description

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5nodejs/node4.0 — 4.*+18
▶NVDnodejs/node.js14.15.0 — 14.20.1+4
▶Debiannodejs/nodejs< 12.22.12~dfsg-1~deb11u3+3
▶Ubuntunodejs/nodejs< 10.19.0~dfsg-3ubuntu1.3+2
▶NVDsiemens/sinec_ins< 1.0+1

Also affects: Debian Linux 10.0, 11.0, Fedora 35, 36, 37

🔴Vulnerability Details

4
OSV
nodejs vulnerabilities↗2023-11-21
▶
GHSA
GHSA-w95h-2gj2-x2p4: A OS Command Injection vulnerability exists in Node↗2022-07-15
▶
CVEList
CVE-2022-32212: A OS Command Injection vulnerability exists in Node↗2022-07-14
▶
OSV
CVE-2022-32212: A OS Command Injection vulnerability exists in Node↗2022-07-14
▶

📋Vendor Advisories

6
Ubuntu
Node.js vulnerabilities↗2023-11-21
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: User Interface (Node.js) — CVE-2022-32212↗2023-01-15
▶
Red Hat
nodejs: DNS rebinding in inspect via invalid octal IP address↗2022-11-04
▶
Microsoft
A OS Command Injection vulnerability exists in Node.js versions <14.20.0 <16.20.0 <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly c↗2022-07-12
▶
Red Hat
nodejs: DNS rebinding in --inspect via invalid IP addresses↗2022-07-08
▶

💬Community

2
HackerOne
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)↗2023-01-12
▶
HackerOne
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)↗2022-09-28
▶
CVE-2022-32212 — Improper Access Control in Nodejs Node | cvebase