DNS rebinding in Node.js - CVE-2021-22884

Vulnerability identifier: #VU50955

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22884

CWE-ID: CWE-350

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DNS rebinding attack.

The vulnerability exists due to the application whitelist includes the “localhost6” name. When “localhost6” is not present in /etc/hosts, it is treated an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain.

Node.js
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
Ubuntu
openEuler
Fedora
Red Hat Software Collections
IBM Netcool Agile Service Manager
IBM Cloud Transformation Advisor
IBM Cloud Automation Manager
verdaccio
MySQL Cluster
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
nodejs (Debian package)
rh-nodejs10-nodejs (Red Hat package)
nodejs (Alpine package)
nodejs-current (Alpine package)
rh-nodejs12-nodejs (Red Hat package)
nodejs (Ubuntu package)
nodejs-dev (Ubuntu package)
nodejs-common
v8-devel
npm
nodejs8
nodejs8-debuginfo
nodejs8-debugsource
nodejs8-devel
npm8
nodejs8-docs
libnode64 (Ubuntu package)
libnode-dev (Ubuntu package)
nodejs-debuginfo
nodejs-full-i18n
nodejs-debugsource
nodejs-libs
nodejs-devel
nodejs
nodejs-docs
nodejs10
nodejs10-debuginfo
nodejs10-docs
npm10
nodejs10-devel
nodejs10-debugsource
nodejs12
nodejs12-docs
npm12
nodejs12-devel
nodejs12-debugsource
nodejs12-debuginfo
rh-nodejs14-nodejs (Red Hat package)
nodejs14-devel
nodejs14
nodejs14-debuginfo
nodejs14-debugsource
npm14
nodejs14-docs
PeopleSoft Enterprise PeopleTools
SINEC INS

Install updates from vendor's website.

Node.js - addressed in versions 10.24.0, 12.21.0, 14.16.0, 15.10.0
IBM Netcool Agile Service Manager - update to 1.1.13
verdaccio - update to 4.11.1
MySQL Cluster - update to 8.0.26
nodejs (Debian package) - update to 10.24.0~dfsg-1~deb10u1
rh-nodejs10-nodejs (Red Hat package) - update to 10.24.0-1.el7
nodejs (Alpine package) - addressed in versions 12.21.0-r0, 14.16.0-r0
nodejs-current (Alpine package) - update to 15.10.0-r0
rh-nodejs12-nodejs (Red Hat package) - update to 12.21.0-1.el7
nodejs (Ubuntu package) - addressed in versions Ubuntu Pro, 10.19.0~dfsg-3ubuntu1.2
nodejs-dev (Ubuntu package) - update to Ubuntu Pro
SINEC INS - update to 1.0.1.1
nodejs-common - update to 2.0-3.2.1
IBM Cloud Automation Manager - update to 4.2.0.1 iFix 3
v8-devel - update to 6.8.275.32-1.10.21.0.6
npm - update to 6.14.4-1.10.21.0.6
nodejs8 - addressed in versions 8.17.0-3.47.2, 8.17.0-10.9.2
nodejs8-debuginfo - addressed in versions 8.17.0-3.47.2, 8.17.0-10.9.2
nodejs8-debugsource - addressed in versions 8.17.0-3.47.2, 8.17.0-10.9.2
nodejs8-devel - addressed in versions 8.17.0-3.47.2, 8.17.0-10.9.2
npm8 - addressed in versions 8.17.0-3.47.2, 8.17.0-10.9.2
nodejs8-docs - addressed in versions 8.17.0-3.47.2, 8.17.0-10.9.2
libnode64 (Ubuntu package) - update to 10.19.0~dfsg-3ubuntu1.2
libnode-dev (Ubuntu package) - update to 10.19.0~dfsg-3ubuntu1.2
nodejs-debuginfo - update to 10.21.0-6
nodejs-full-i18n - update to 10.21.0-6
nodejs-debugsource - update to 10.21.0-6
nodejs-libs - update to 10.21.0-6
nodejs-devel - update to 10.21.0-6
nodejs - update to 10.21.0-6
nodejs-docs - update to 10.21.0-6
nodejs10 - addressed in versions 10.24.0-1.33.2, 10.24.0-1.36.2
nodejs10-debuginfo - addressed in versions 10.24.0-1.33.2, 10.24.0-1.36.2
nodejs10-docs - addressed in versions 10.24.0-1.33.2, 10.24.0-1.36.2
npm10 - addressed in versions 10.24.0-1.33.2, 10.24.0-1.36.2
nodejs10-devel - addressed in versions 10.24.0-1.33.2, 10.24.0-1.36.2
nodejs10-debugsource - addressed in versions 10.24.0-1.33.2, 10.24.0-1.36.2
nodejs - addressed in versions 10-3220210223224027.43bbeeef, 10-3320210223224027.601d93de, 10-3420210223224027.058368ca, 12.21.0-2.fc32, 12-3220210225180352.43bbeeef, 12-3320210223224147.601d93de, 12-3420210225180352.058368ca, 14.16.0-1.fc33, 14.16.0-1.fc34, 14-3220210223224243.43bbeeef, 14-3320210223224243.601d93de, 15-3220210303194449.43bbeeef, 15-3320210303194449.601d93de, 15-3420210303194449.058368ca
nodejs12 - addressed in versions 12.21.0-1.29.2, 12.21.0-4.13.2
nodejs12-docs - addressed in versions 12.21.0-1.29.2, 12.21.0-4.13.2
npm12 - addressed in versions 12.21.0-1.29.2, 12.21.0-4.13.2
nodejs12-devel - addressed in versions 12.21.0-1.29.2, 12.21.0-4.13.2
nodejs12-debugsource - addressed in versions 12.21.0-1.29.2, 12.21.0-4.13.2
nodejs12-debuginfo - addressed in versions 12.21.0-1.29.2, 12.21.0-4.13.2
rh-nodejs14-nodejs (Red Hat package) - update to 14.16.0-1.el7
nodejs14-devel - addressed in versions 14.16.0-5.9.1, 14.16.0-6.9.2
nodejs14 - addressed in versions 14.16.0-5.9.1, 14.16.0-6.9.2
nodejs14-debuginfo - addressed in versions 14.16.0-5.9.1, 14.16.0-6.9.2
nodejs14-debugsource - addressed in versions 14.16.0-5.9.1, 14.16.0-6.9.2
npm14 - addressed in versions 14.16.0-5.9.1, 14.16.0-6.9.2
nodejs14-docs - addressed in versions 14.16.0-5.9.1, 14.16.0-6.9.2

• https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/

• Multiple vulnerabilities in Node.js
• Debian update for nodejs
• DNS rebinding in nodejs-current (Alpine package)
• DNS rebinding in nodejs (Alpine package)
• verdaccio update for Node.js
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:10 module
• Red Hat Enterprise Linux 8.2 update for the nodejs:10 module
• Red Hat Enterprise Linux 8.1 update for the nodejs:12 module
• Red Hat Enterprise Linux 8.2 update for the nodejs:12 module
• Red Hat Enterprise Linux 8.1 update for the nodejs:10 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Red Hat Software Collections update for rh-nodejs14-nodejs
• Red Hat Software Collections update for rh-nodejs12-nodejs
• Red Hat Software Collections update for rh-nodejs10-nodejs
• Multiple vulnerabilities in MySQL Cluster
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple Vulnerabilities in IBM Netcool Agile Service Manager
• SUSE update for nodejs14
• SUSE update for nodejs12
• SUSE update for nodejs14
• SUSE update for nodejs12
• SUSE update for nodejs8
• SUSE update for nodejs10
• SUSE update for nodejs10
• SUSE update for nodejs8
• Multiple vulnerabilities in IBM Cloud Automation Manager
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Ubuntu update for nodejs
• openEuler update for nodejs
• Gentoo update for Node.js
• Fedora 32 Modular update for nodejs, nodejs, nodejs
• Fedora 34 update for nodejs
• Fedora 34 Modular update for nodejs, nodejs
• Fedora 33 Modular update for nodejs, nodejs, nodejs
• Fedora 32 update for nodejs
• Fedora 33 update for nodejs
• Fedora 32 Modular update for nodejs
• Fedora 34 Modular update for nodejs
• Fedora 33 Modular update for nodejs