Improper error handling in http-proxy-middleware - CVE-2024-21536

Vulnerability identifier: #VU101027

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-21536

CWE-ID: CWE-388

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an UnhandledPromiseRejection error thrown by micromatch. A remote non-authenticated attacker can send specially crafted request to the application and crash the Node.js process.

http-proxy-middleware
IBM Fusion HCI
IBM Security Verify Governance
IBM Cloud Pak for Security
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Maximo Application Suite - Manage Component
PowerProtect Data Manager
IBM Cloud Pak for Business Automation
IBM Cloud Pak System
IBM Edge Application Manager
Migration Toolkit for Containers
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Cloud Pak for Watson AIOps
watsonx Assistant for IBM Cloud Pak for Data
Cognos Dashboards on Cloud Pak for Data
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
QRadar Log Source Management App
Business Automation Insights

Install updates from vendor's website.

http-proxy-middleware - addressed in versions 2.0.7, 3.0.3
IBM Fusion HCI - update to 2.10.0
IBM Cloud Pak System - update to 2.3.6.0
IBM Security Verify Governance - update to 10.0.2.0.7
Migration Toolkit for Containers - update to 1.8.7
IBM Cloud Pak for Security - update to 1.11.0.0
OpenShift Service Mesh - update to 2.6.3
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4, 4.14.18, 4.15.14, 4.17.7
IBM Cloud Pak for Watson AIOps - update to 4.8.1
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.8.8
watsonx Assistant for IBM Cloud Pak for Data - update to 4.8.8
App Connect Enterprise Certified Container - addressed in versions 5.0.22, 12.0.5, 12.5.1
Cognos Dashboards on Cloud Pak for Data - update to 5.1.1
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
QRadar Log Source Management App - update to 7.0.11
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.26, 8.7.20, 9.0.13
PowerProtect Data Manager - update to 19.19.0-15
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Business Automation Insights - addressed in versions 24.0.0.0.2, 24.0.1.0.1

• https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906
• https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a
• https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22
• https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5

• Remote denial of service in http-proxy-middleware
• Improper error handling in OpenShift Service Mesh 2.6
• IBM App Connect Enterprise Certified Container Dashboard and DesignerAuthoring update for http-proxy-middleware
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• IBM Watson Discovery update for http-proxy-middleware
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM Watson Assistant for IBM Cloud Pak for Data update for http-proxy-middleware
• IBM watsonx Assistant for IBM Cloud Pak for Data update for http-proxy-middleware
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM Business Automation Insights
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for http-proxy-middleware
• Multiple vulnerabilities in Dell PowerProtect Data Manager
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• IBM Maximo Application Suite - Manage Component update for http-proxy-middleware
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.15
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.14
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Security Verify Governance