CVE-2020-8201: XSS
A flaw was found in Node.js, where affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This flaw leads to HTTP Request Smuggling as it is a non-standard interpretation of the header. The highest threat from this vulnerability is to confidentiality and integrity.
Other sources
Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.
Upstream advisory:
https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/
— Red Hat
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
Node.js is vulnerable to HTTP request smuggling, caused by CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8201?
CVE-2020-8201 is a vulnerability in Node.js that allows for HTTP request smuggling due to CR-to-Hyphen conversion.
How can Node.js be exploited using CVE-2020-8201?
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads.
What are the potential attacks that can be performed using CVE-2020-8201?
CVE-2020-8201 can be used to hijack user sessions, poison cookies, perform clickjacking, and more.
Which versions of Node.js are affected by CVE-2020-8201?
Node.js versions < 12.18.4 and < 14.11 are affected by CVE-2020-8201.
What is the severity of CVE-2020-8201?
CVE-2020-8201 has a severity rating of 7.4 (high).