CVE-2022-32214
Vulnerability from cvelistv5
Published
2022-07-14 00:00
Modified
2024-08-03 07:32
Severity
Summary
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
References
SourceURLTags
support@hackerone.comhttps://hackerone.com/reports/1524692Exploit, Issue Tracking, Third Party Advisory
support@hackerone.comhttps://nodejs.org/en/blog/vulnerability/july-2022-security-releases/Patch, Vendor Advisory
support@hackerone.comhttps://www.debian.org/security/2023/dsa-5326Third Party Advisory
Impacted products
VendorProduct
n/ahttps://github.com/nodejs/node
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:32:55.986Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1524692"
          },
          {
            "name": "DSA-5326",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5326"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/nodejs/node",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 14.20.1+, 16.17.1+,18.9.1+"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The llhttp parser \u003cv14.20.1, \u003cv16.17.1 and \u003cv18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "HTTP Request Smuggling (CWE-444)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-25T00:00:00",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/"
        },
        {
          "url": "https://hackerone.com/reports/1524692"
        },
        {
          "name": "DSA-5326",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5326"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2022-32214",
    "datePublished": "2022-07-14T00:00:00",
    "dateReserved": "2022-06-01T00:00:00",
    "dateUpdated": "2024-08-03T07:32:55.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-32214\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2022-07-14T15:15:08.337\",\"lastModified\":\"2023-07-19T00:55:52.457\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The llhttp parser \u003cv14.20.1, \u003cv16.17.1 and \u003cv18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).\"},{\"lang\":\"es\",\"value\":\"El parser llhttp anteriores a la versi\u00f3n v14.20.1, anteriores a la versi\u00f3n v16.17.1 y anteriores a la versi\u00f3n v18.9.1 del m\u00f3dulo http en Node.js no utiliza estrictamente la secuencia CRLF para delimitar las peticiones HTTP. Esto puede llevar a un contrabando de peticiones HTTP (HRS)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]},{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"2.1.5\",\"matchCriteriaId\":\"C2150173-C986-4D63-AA7F-9618AA856F2C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.7\",\"matchCriteriaId\":\"FBB4A716-D0D0-4319-BAF0-7F012973330A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"14.0.0\",\"versionEndIncluding\":\"14.14.0\",\"matchCriteriaId\":\"428DCD7B-6F66-4F18-B780-5BD80143D482\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"14.15.0\",\"versionEndExcluding\":\"14.20.0\",\"matchCriteriaId\":\"3EB02718-B2A5-4822-B611-D62BB9EF44B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"16.0.0\",\"versionEndIncluding\":\"16.12.0\",\"matchCriteriaId\":\"1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"16.13.0\",\"versionEndExcluding\":\"16.16.0\",\"matchCriteriaId\":\"D9D9B02E-C965-408B-999E-1F3DA09B62AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"18.0.0\",\"versionEndExcluding\":\"18.5.0\",\"matchCriteriaId\":\"D224E154-915A-4E2C-A0D7-D28D1C1472F7\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3.0\",\"matchCriteriaId\":\"5A8085B7-6068-464E-B00E-638F49F60730\"}]}]}],\"references\":[{\"url\":\"https://hackerone.com/reports/1524692\",\"source\":\"support@hackerone.com\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.debian.org/security/2023/dsa-5326\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.