CVE-2016-2216

HIGH

Nodejs Node.js - Improper Input Validation

Title source: rule

Description

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

References (8)

[Various Sources] http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/

[Various Sources] http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html

[Patch, Vendor Advisory] https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/83141

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html

[Third Party Advisory] https://security.gentoo.org/glsa/201612-43

Scores

CVSS v3 7.5

EPSS 0.0184

EPSS Percentile 82.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Classification

CWE

CWE-20

Status draft

Affected Products (50)

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

... and 35 more

Timeline

Published Apr 07, 2016

Tracked Since Feb 18, 2026