Bug 1561979 (CVE-2018-7160) - CVE-2018-7160 nodejs: Inspector DNS rebinding vulnerability
Summary: CVE-2018-7160 nodejs: Inspector DNS rebinding vulnerability
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-7160
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1562026 1562027 Red Hat1562028 Engineering1562034 Engineering1564425 Engineering1564426 Red Hat1565264
Blocks: Embargoed1561987
TreeView+ depends on / blocked
 
Reported: 2018-03-29 09:50 UTC by Adam Mariš
Modified: 2021-01-15 12:21 UTC (History)
19 users (show)

Fixed In Version: nodejs 8.11.0, nodejs 6.14.0, nodejs 9.10.0
Doc Type: If docs needed, set a value
Doc Text:
It was found that when a Node.js script is run in inspector mode, Node.js did not properly validate the Host header, leaving the inspector vulnerable to a DNS rebind attack and bypass same-origin policy. If a developer had an inspector session running, and was visiting a malicious website, the site could carry on a DNS rebind attack, allowing the site to have full access to the debugged script.
Clone Of:
Environment:
Last Closed: 2021-01-15 12:21:27 UTC

Attachments (Terms of Use)

Description Adam Mariš 2018-03-29 09:50:14 UTC 
A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access.

References:

https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md
Comment 1 Adam Mariš 2018-03-29 12:08:15 UTC 
Created nodejs tracking bugs for this issue:

Affects: fedora-all [bug 1562027]
Affects: epel-all [bug 1562026]
Comment 7 Cedric Buissart 2018-04-05 11:52:43 UTC 
rh-nodejs4-nodejs is not affected since NodeJS 4 has no support for the inspector.
Comment 12 Jason Shepherd 2018-06-13 21:19:33 UTC 
NodeJS is only packaged as an ImageStream in Openshift Enterprise 3.9, which is a container image from RH Software Collections. Marking Openshift Enterprise as not affected.
Comment 13 Cedric Buissart 2018-11-08 15:18:50 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2018:2949 https://access.redhat.com/errata/RHSA-2018:2949
Note You need to log in before you can comment on or make changes to this bug.