Inconsistent interpretation of HTTP requests in Node.js - CVE-2020-8201

Vulnerability identifier: #VU47218

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8201

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Node.js
MicroSCADA Pro SYS600
MicroSCADA X SYS600
Gateway Station (GWS)
FACTS Control Platform (FCP)
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Opensuse
Fedora
IBM Cloud Transformation Advisor
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
rh-nodejs12-nodejs (Red Hat package)
nodejs (Alpine package)
nodejs-current (Alpine package)
nodejs (Red Hat package)
nodejs

Install update from vendor's website.

Node.js - update to 14.11.0
MicroSCADA Pro SYS600 - update to 10.3
MicroSCADA X SYS600 - update to 10.3
rh-nodejs12-nodejs (Red Hat package) - update to 12.18.4-3.el7
nodejs (Alpine package) - update to 12.18.4-r0
nodejs-current (Alpine package) - update to 14.11.0-r0
nodejs (Red Hat package) - update to 12.18.4-2.module+el8.2.0+8361+192e434e
nodejs - addressed in versions 12.19.0-1.fc31, 14.15.1-1.fc33, 14-3220201203015508.43bbeeef, 14-3320201203015508.601d93de

• https://hackerone.com/reports/922597
• https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/

• Inconsistent interpretation of HTTP requests in nodejs (Alpine package)
• Inconsistent interpretation of HTTP requests in nodejs-current (Alpine package)
• OpenSUSE Linux update for nodejs12
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Software Collections update for rh-nodejs12-nodejs
• Gentoo update for NodeJS
• Multiple vulnerabilities in Hitachi Energy MicroSCADA Pro/X SYS600
• Multiple vulnerabilities in Hitachi Energy FACTS Control Platform (FCP)
• Multiple vulnerabilities in Hitachi Energy Gateway Station (GWS)
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Fedora 31 update for nodejs
• Fedora 32 Modular update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 33 update for nodejs