HTTP request smuggling in Node.js - CVE-2020-8287

Vulnerability identifier: #VU49253

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8287

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Node.js
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Ubuntu
openEuler
Fedora
MicroSCADA Pro SYS600
MicroSCADA X SYS600
Gateway Station (GWS)
FACTS Control Platform (FCP)
SINEC INS
IBM Netcool Agile Service Manager
IBM Cloud Transformation Advisor
IBM Security Guardium Insights
EasyApache
IBM Watson Assistant for IBM Cloud Pak for Data
nodejs (Alpine package)
nodejs (Debian package)
nodejs-current (Alpine package)
nodejs-legacy (Ubuntu package)
nodejs-dev (Ubuntu package)
nodejs (Ubuntu package)
rh-nodejs12-nodejs-nodemon (Red Hat package)
libhttp-parser2.7.1 (Ubuntu package)
v8-devel
npm
libnode64 (Ubuntu package)
libnode-dev (Ubuntu package)
nodejs-libs
nodejs-docs
nodejs-debugsource
nodejs-full-i18n
nodejs-devel
nodejs
nodejs-debuginfo
rh-nodejs10-nodejs (Red Hat package)
rh-nodejs12-nodejs (Red Hat package)
rh-nodejs14-nodejs (Red Hat package)
IBM DataPower Gateway

Install updates from vendor's website.

Node.js - addressed in versions 10.23.1, 12.20.1, 14.15.4, 15.5.1
MicroSCADA Pro SYS600 - update to 10.3
MicroSCADA X SYS600 - update to 10.3
IBM Netcool Agile Service Manager - update to 1.1.13
IBM Security Guardium Insights - update to 3.0
EasyApache - update to 4 20201-3-3
nodejs (Alpine package) - update to 14.15.4-r0
nodejs (Debian package) - update to 10.23.1~dfsg-1~deb10u1
nodejs-current (Alpine package) - update to 15.5.1-r0
nodejs-legacy (Ubuntu package) - update to Ubuntu Pro
nodejs-dev (Ubuntu package) - update to Ubuntu Pro
nodejs (Ubuntu package) - addressed in versions Ubuntu Pro, 10.19.0~dfsg-3ubuntu1.1
SINEC INS - update to 1.0.1.1
rh-nodejs12-nodejs-nodemon (Red Hat package) - update to 2.0.3-1.el7
libhttp-parser2.7.1 (Ubuntu package) - update to 2.7.1-2ubuntu0.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.0.0
v8-devel - update to 6.8.275.32-1.10.21.0.4.oe1
npm - update to 6.14.4-1.10.21.0.4.oe1
IBM DataPower Gateway - addressed in versions 10.0.1.4, 10.0.3.0, 2018.4.1.17
libnode64 (Ubuntu package) - update to 10.19.0~dfsg-3ubuntu1.1
libnode-dev (Ubuntu package) - update to 10.19.0~dfsg-3ubuntu1.1
nodejs-libs - update to 10.21.0-4
nodejs-docs - update to 10.21.0-4
nodejs-debugsource - update to 10.21.0-4
nodejs-full-i18n - update to 10.21.0-4
nodejs-devel - update to 10.21.0-4
nodejs - update to 10.21.0-4
nodejs-debuginfo - update to 10.21.0-4
rh-nodejs10-nodejs (Red Hat package) - update to 10.23.1-2.el7
nodejs - addressed in versions 10-3220210105182003.43bbeeef, 10-3320210105182003.601d93de, 12.20.1-1.fc32, 12-3220210105181808.43bbeeef, 12-3320210105181808.601d93de, 14.15.4-1.fc33, 14-3220210105180508.43bbeeef, 14-3320210105180508.601d93de
rh-nodejs12-nodejs (Red Hat package) - update to 12.20.1-1.el7
rh-nodejs14-nodejs (Red Hat package) - update to 14.15.4-2.el7

• Exploit #4994 - nodejs-http-transfer-encoding-smuggling-poc (PoC of HTTP Request Smuggling in nodejs (CVE-2020-8287)) (January 5, 2021)

• https://nodejs.org/en/blog/release/v10.23.1/
• https://nodejs.org/en/blog/release/v12.20.1/
• https://nodejs.org/en/blog/release/v14.15.4/
• https://nodejs.org/en/blog/release/v15.5.1/

• Multiple vulnerabilities in Node.js
• HTTP request smuggling in nodejs (Alpine package)
• HTTP request smuggling in nodejs-current (Alpine package)
• Debian update for nodejs
• Gentoo update for NodeJS
• Arch Linux update for nodejs
• Arch Linux update for nodejs-lts-dubnium
• Arch Linux update for nodejs-lts-erbium
• Arch Linux update for nodejs-lts-fermium
• EasyApache 4 update for NodeJS
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in Hitachi Energy MicroSCADA Pro/X SYS600
• Multiple Vulnerabilities in IBM Netcool Agile Service Manager
• Ubuntu update for http-parser
• Multiple vulnerabilities in Hitachi Energy FACTS Control Platform (FCP)
• Multiple vulnerabilities in Hitachi Energy Gateway Station (GWS)
• Multiple vulnerabilities in IBM DataPower Gateway
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Ubuntu update for nodejs
• openEuler update for nodejs
• Red Hat Software Collections update for rh-nodejs14-nodejs
• Red Hat Software Collections update for rh-nodejs12-nodejs
• Red Hat Software Collections update for rh-nodejs10-nodejs
• Red Hat Enterprise Linux 8 update for the nodejs:10 module
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Fedora 32 Modular update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 32 update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 32 Modular update for nodejs
• Fedora 32 Modular update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 33 update for nodejs
• Multiple vulnerabilities in IBM Security Guardium Insights