CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion
A flaw was found in Node.js, where affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This flaw leads to HTTP Request Smuggling as it is a non-standard interpretation of the header. The highest threat from this vulnerability is to confidentiality and integrity.
Other sources
Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.
All versions of the 14.x and 12.x releases line
— Node.Js
Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.
Upstream advisory:
https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/
— Red Hat
HTTP Request Smuggling due to CR-to-Hyphen conversion
— Node.Js
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
Node.js is vulnerable to HTTP request smuggling, caused by CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-nodejs12-nodejsto a version that resolves this vulnerability.Fixed in 0:12.18.4-3.el7 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 14.11.0 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 12.18.4 - Upgrade
Upgrade
redhat/llhttpto a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.18.4Fixed in 14.11.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.18.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.11.0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 12.20.1-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 12.18.4-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 14.11.0-r0 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 12.18.4 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 14.11
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8201?
CVE-2020-8201 is a vulnerability in Node.js that allows for HTTP request smuggling due to CR-to-Hyphen conversion.
How can Node.js be exploited using CVE-2020-8201?
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads.
What are the potential attacks that can be performed using CVE-2020-8201?
CVE-2020-8201 can be used to hijack user sessions, poison cookies, perform clickjacking, and more.
Which versions of Node.js are affected by CVE-2020-8201?
Node.js versions < 12.18.4 and < 14.11 are affected by CVE-2020-8201.
What is the severity of CVE-2020-8201?
CVE-2020-8201 has a severity rating of 7.4 (high).