What is CVE-2017-16005?

CVE-2017-16005 is a vulnerability in the HTTP Signature Scheme implementation in versions <=0.9.11 of Joyent's http-signature.

What is the severity of CVE-2017-16005?

The severity of CVE-2017-16005 is high with a CVSS score of 7.5.

How can an attacker exploit CVE-2017-16005?

An attacker in a privileged network position can exploit CVE-2017-16005 to modify header names and change the meaning of the request without updating the signature.

Which versions of http-signature are affected by CVE-2017-16005?

Versions <=0.9.11 of http-signature are affected by CVE-2017-16005.

How can I fix CVE-2017-16005?

To fix CVE-2017-16005, update to version 0.10.0 or higher of http-signature.

Vulnerability/
CVE-2017-16005

high

7.5

CWE

20 347

4/6/2018

9/11/2018

16/9/2024

CVE-2017-16005: Input Validation

Q: What is the severity of CVE-2017-16005?

The severity of CVE-2017-16005 is high with a CVSS score of 7.5.

Q: How can an attacker exploit CVE-2017-16005?

An attacker in a privileged network position can exploit CVE-2017-16005 to modify header names and change the meaning of the request without updating the signature.

Q: Which versions of http-signature are affected by CVE-2017-16005?

Versions <=0.9.11 of http-signature are affected by CVE-2017-16005.

Q: How can I fix CVE-2017-16005?

To fix CVE-2017-16005, update to version 0.10.0 or higher of http-signature.

First published: Mon Jun 04 2018(Updated: )

Affected versions of `http-signature` contain a vulnerability which can allow an attacker in a privileged network position to modify header names and change the meaning of the request, without requiring an updated signature. This problem occurs because vulnerable versions of `http-signature` sign the contents of headers, but not the header names. ## Proof of Concept Consider this to be the initial, untampered request: ```http POST /pay HTTP/1.1 Host: example.com Date: Thu, 05 Jan 2012 21:31:40 GMT X-Payment-Source: src@money.com X-Payment-Destination: dst@money.com Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-source x-payment-destination" MDyO5tSvin5... ``` And the request is intercepted and tampered as follows: ```http X-Payment-Source: dst@money.com // Emails switched X-Payment-Destination: src@money.com Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-destination x-payment-source" MDyO5tSvin5... ``` In the resulting responses, both requests would pass signature verification without issue. ``` src@money.com\n dst@money.com\n ``` ## Recommendation Update to version 0.10.0 or higher.

Credit: support@hackerone.com support@hackerone.com

Affected Software	Affected Version	How to fix
Joyent Http-signature	<=0.9.11

Remedy

https://github.com/joyent/node-http-signature/issues/10

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2017-16005?
CVE-2017-16005 is a vulnerability in the HTTP Signature Scheme implementation in versions <=0.9.11 of Joyent's http-signature.
What is the severity of CVE-2017-16005?
The severity of CVE-2017-16005 is high with a CVSS score of 7.5.
How can an attacker exploit CVE-2017-16005?
An attacker in a privileged network position can exploit CVE-2017-16005 to modify header names and change the meaning of the request without updating the signature.
Which versions of http-signature are affected by CVE-2017-16005?
Versions <=0.9.11 of http-signature are affected by CVE-2017-16005.
How can I fix CVE-2017-16005?
To fix CVE-2017-16005, update to version 0.10.0 or higher of http-signature.

collector/github-advisory-latest
alias/GHSA-q257-vv4p-fg92
alias/CVE-2017-16005
collector/github-advisory
collector/nvd-index
collector/nvd-cve
agent/type
agent/author
agent/description
agent/event
agent/remedy
agent/first-publish-date
agent/severity
agent/weakness
agent/tags
agent/last-modified-date
agent/references
agent/softwarecombine
collector/mitre-cve
source/MITRE
package-manager/npm
vendor/joyent
canonical/joyent http-signature
version/joyent http-signature/0.9.11