HTTP Server Security Vulnerability: Please upgrade to 0.6.17
A security vulnerability in Node.js's HTTP parser could allow remote attackers to exploit buffer handling in the HTTP parser, potentially leading to information disclosure. The issue affects versions prior to 0.6.17 and 0.7.8, and is resolved in these updates.
Overview of the HTTP Server Security Vulnerability
A vulnerability was identified in the HTTP parser implementation of Node.js, specifically in the node::StringPtr::Update function. This flaw could allow an attacker to manipulate the buffer handling in the HTTP parser, potentially leading to information disclosure. The vulnerability arises from an incorrect check in the code that determines whether a string update can be safely performed. This mistake allows an attacker to append data from one request to another, potentially exposing sensitive information.
Impact and Affected Versions
The vulnerability affects all versions of the 0.5 and 0.6 branches prior to 0.6.17, and all versions of the 0.7 branch prior to 0.7.8. It is important to note that versions in the 0.4 branch are not affected by this issue. The flaw could theoretically enable header-spoofing attacks, although no such attack has been demonstrated publicly.
Technical Details and Exploitation
The vulnerability was discovered by Matthew Daley, who responsibly reported it to the Node.js team. The issue stems from an incorrect use of the size variable instead of size_ in the node::StringPtr::Update function. This allows an attacker to craft a request that causes the HTTP parser to append data from one request to another. This can be exploited by sending an HTTP header with an empty value, followed by a continuation with a specific length, which can then be used to inject data into the buffer.
Fix and Recommendations
The vulnerability was fixed in the commits 7b3fb22 and c9a231d for the master and v0.6 branches, respectively. The first releases with the fix are v0.7.8 and 0.6.17. Users of Node.js version 0.6 in production are strongly advised to upgrade to at least v0.6.17 or apply the fix manually. This update also includes several other important bug fixes and is considered the most stable release of Node 0.6 to date.
Conclusion
This vulnerability highlights the importance of timely updates and responsible disclosure in the open-source community. The fix was implemented and released promptly, and users are encouraged to upgrade their systems to mitigate the risk of exploitation. As always, it is crucial to stay informed about security updates and apply them as soon as possible to ensure the security of your applications.
Source: Node.js. Analysis based on publicly available information; no hands-on testing is claimed.
