Fluid Attacks Database

Description

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	nodejs	>=0 <18.6.0+dfsg-3	18.6.0+dfsg-3
debian 11	nodejs	=12.21.0~dfsg-5 \|\| =12.22.10~dfsg-1 \|\| =12.22.10~dfsg-2 \|\| =12.22.12~dfsg-1~deb11u1 \|\| =12.22.12~dfsg-1~deb11u2 \|\| =12.22.4~dfsg-1 \|\| =12.22.5~dfsg-1 \|\| =12.22.5~dfsg-2 \|\| =12.22.5~dfsg-2~11u1 \|\| =12.22.5~dfsg-3 \|\| =12.22.5~dfsg-4 \|\| =12.22.5~dfsg-5 \|\| =12.22.5~dfsg-6 \|\| =12.22.5~dfsg-7 \|\| =12.22.7~dfsg-1 \|\| =12.22.7~dfsg-2 \|\| =12.22.9~dfsg-1 \|\| >=0 <12.22.12~dfsg-1~deb11u3	12.22.12~dfsg-1~deb11u3
debian 12	nodejs	>=0 <18.6.0+dfsg-3	18.6.0+dfsg-3
debian 14	nodejs	>=0 <18.6.0+dfsg-3	18.6.0+dfsg-3
rpm rhel8	nodejs	<1:14.20.0-2.module+el8.6.0+16231+7c1b33d9	1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
rpm rhel8.4	nodejs	<1:14.20.0-2.module+el8.4.0+16234+70f4adc8	1:14.20.0-2.module+el8.4.0+16234+70f4adc8
rpm rhel9	nodejs	<1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
npm	node	>=14.0.0 <=14.14.0 \|\| >=14.15.0 <14.20.1 \|\| >=16.0.0 <=16.12.0 \|\| >=16.13.0 <16.17.1 \|\| >=18.0.0 <18.5.0	14.20.1, 16.17.1, 18.5.0

Aliases

1. CVE-2022-322122. NVD-2022-322123. OSV-DEBIAN-2022-322124. OSV-2022-322125. GCVE-2022-322126. SECURITY-TRACKER-CVE-2022-322127. https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32212.json

References

1. https://hackerone.com/reports/1632921

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.