Improper input validation in Node.js - CVE-2018-7160
Published: May 10, 2018
Vulnerability identifier: #VU12576
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-7160
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Node.js Foundation
Affected software:
Node.js
Node.js
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to improper validation of the Host header, leaving the inspector vulnerable to a DNS rebind attack and bypass same-origin policy. A remote attacker can trick the victim into opening a specially crafted website and execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists due to improper validation of the Host header, leaving the inspector vulnerable to a DNS rebind attack and bypass same-origin policy. A remote attacker can trick the victim into opening a specially crafted website and execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
How to mitigate CVE-2018-7160
Install update from vendor's website.