CVE-2022-43548 - nodejs: DNS rebinding in inspect via invalid octal IP address

Back Back to CVE browser

HIGH

nodejs: DNS rebinding in inspect via invalid octal IP address

Published Dec 5, 2022

8.1

HIGH

CVSS 3.1

EPSS 14.55%

Description

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Affected products

Vendor Node.js Product Node Default
unaffected
- Version
  10.0
  Status
  affected
  Constraints
  <10.*
- Version
  11.0
  Status
  affected
  Constraints
  <11.*
- Version
  12.0
  Status
  affected
  Constraints
  <12.*
- Version
  13.0
  Status
  affected
  Constraints
  <13.*
- Version
  14.0
  Status
  affected
  Constraints
  <14.21.1
- Version
  15.0
  Status
  affected
  Constraints
  <15.*
- Version
  16.0
  Status
  affected
  Constraints
  <16.18.1
- Version
  17.0
  Status
  affected
  Constraints
  <17.*
- Version
  18.0
  Status
  affected
  Constraints
  <18.12.1
- Version
  19.0
  Status
  affected
  Constraints
  <19.0.1
- Version
  4.0
  Status
  affected
  Constraints
  <4.*
- Version
  5.0
  Status
  affected
  Constraints
  <5.*
- Version
  6.0
  Status
  affected
  Constraints
  <6.*
- Version
  7.0
  Status
  affected
  Constraints
  <7.*
- Version
  8.0
  Status
  affected
  Constraints
  <8.*
- Version
  9.0
  Status
  affected
  Constraints
  <9.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Node.js

Node

unaffected

Version	Status	Constraints
10.0	affected	<10.*
11.0	affected	<11.*
12.0	affected	<12.*
13.0	affected	<13.*
14.0	affected	<14.21.1
15.0	affected	<15.*
16.0	affected	<16.18.1
17.0	affected	<17.*
18.0	affected	<18.12.1
19.0	affected	<19.0.1
4.0	affected	<4.*
5.0	affected	<5.*
6.0	affected	<6.*
7.0	affected	<7.*
8.0	affected	<8.*
9.0	affected	<9.*

Red Hat Enterprise Linux 8

nodejs:14-8070020221212161539.bd1311ed

Fixed · RHSA-2023:0050
Red Hat Enterprise Linux 8

nodejs:16-8070020221207164159.bd1311ed

Fixed · RHSA-2022:9073
Red Hat Enterprise Linux 8

nodejs:18-8070020221118123310.bd1311ed

Fixed · RHSA-2022:8833
Red Hat Enterprise Linux 8.4 Extended Update Support

nodejs:14-8040020230306170312.522a0ee4

Fixed · RHSA-2023:1533
Red Hat Enterprise Linux 8.6 Extended Update Support

nodejs:14-8060020230306170237.ad008a3a

Fixed · RHSA-2023:1742
Red Hat Enterprise Linux 9

nodejs-1:16.18.1-3.el9_1

Fixed · RHSA-2023:0321
Red Hat Enterprise Linux 9

nodejs:18-9010020221118120946.rhel9

Fixed · RHSA-2022:8832
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs14-nodejs-0:14.21.1-3.el7

Fixed · RHSA-2023:0612
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7

Fixed · RHSA-2023:0612

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	nodejs:14-8070020221212161539.bd1311ed	Fixed	RHSA-2023:0050
Red Hat Enterprise Linux 8	nodejs:16-8070020221207164159.bd1311ed	Fixed	RHSA-2022:9073
Red Hat Enterprise Linux 8	nodejs:18-8070020221118123310.bd1311ed	Fixed	RHSA-2022:8833
Red Hat Enterprise Linux 8.4 Extended Update Support	nodejs:14-8040020230306170312.522a0ee4	Fixed	RHSA-2023:1533
Red Hat Enterprise Linux 8.6 Extended Update Support	nodejs:14-8060020230306170237.ad008a3a	Fixed	RHSA-2023:1742
Red Hat Enterprise Linux 9	nodejs-1:16.18.1-3.el9_1	Fixed	RHSA-2023:0321
Red Hat Enterprise Linux 9	nodejs:18-9010020221118120946.rhel9	Fixed	RHSA-2022:8832
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs14-nodejs-0:14.21.1-3.el7	Fixed	RHSA-2023:0612
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7	Fixed	RHSA-2023:0612

Remediation

Red Hat statement

Redhat has marked this vulnerability as moderate for two primary reasons. 1. The vulnerable inspect functionality might not be enabled, exposed, or reachable in many deployments. 2.The code path might require very specific configurations or conditions (e.g. DNS rebinding, certain host/IP setups) that are rare in default environments.

Weaknesses (2)

CWE-350

CWE-78

OS Command Injection

References (11)

https://access.redhat.com/security/cve/CVE-2022-43548
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2140911
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46545
Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
mailing-listMailing ListThird Party Advisory
https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/
PatchVendor Advisory
https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548
https://nvd.nist.gov/vuln/detail/CVE-2022-43548
https://security.netapp.com/advisory/ntap-20230120-0004/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230427-0007/
https://www.cve.org/CVERecord?id=CVE-2022-43548
https://www.debian.org/security/2023/dsa-5326
vendor-advisoryThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-43548		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2140911		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46545		Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html		mailing-listMailing ListThird Party Advisory
https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/		PatchVendor Advisory
https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548
https://nvd.nist.gov/vuln/detail/CVE-2022-43548
https://security.netapp.com/advisory/ntap-20230120-0004/		Third Party Advisory
https://security.netapp.com/advisory/ntap-20230427-0007/
https://www.cve.org/CVERecord?id=CVE-2022-43548
https://www.debian.org/security/2023/dsa-5326		vendor-advisoryThird Party Advisory