Bug 1561979 (CVE-2018-7160)

Summary:	CVE-2018-7160 nodejs: Inspector DNS rebinding vulnerability
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, athmanem, bleanhar, ccoleman, dbaker, dedgar, dmcphers, hhorak, jgoulding, jokerman, jorton, mchappel, mrunge, nodejs-sig, rhel8-maint, sgallagh, tchollingsworth, thrcka, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs 8.11.0, nodejs 6.14.0, nodejs 9.10.0	Doc Type:	If docs needed, set a value
Doc Text:	It was found that when a Node.js script is run in inspector mode, Node.js did not properly validate the Host header, leaving the inspector vulnerable to a DNS rebind attack and bypass same-origin policy. If a developer had an inspector session running, and was visiting a malicious website, the site could carry on a DNS rebind attack, allowing the site to have full access to the debugged script.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-01-15 12:21:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1562026, 1562027, 1562028, 1562034, 1564425, 1564426, 1565264
Bug Blocks:	1561987

Description Adam Mariš 2018-03-29 09:50:14 UTC

A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access.

References:

https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md

Comment 1 Adam Mariš 2018-03-29 12:08:15 UTC

Created nodejs tracking bugs for this issue:

Affects: fedora-all [bug 1562027]
Affects: epel-all [bug 1562026]

Comment 7 Cedric Buissart 2018-04-05 11:52:43 UTC

rh-nodejs4-nodejs is not affected since NodeJS 4 has no support for the inspector.

Comment 12 Jason Shepherd 2018-06-13 21:19:33 UTC

NodeJS is only packaged as an ImageStream in Openshift Enterprise 3.9, which is a container image from RH Software Collections. Marking Openshift Enterprise as not affected.

Comment 13 Cedric Buissart 2018-11-08 15:18:50 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2018:2949 https://access.redhat.com/errata/RHSA-2018:2949