Vulnerability in Nodejs Node
CVE-2020-8201
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
Vulnerability class: HTTP Request Smuggling
EPSS: 0.051 (91.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Nodejs Node — versions 4.0, 5.0, 6.0
- Nodejs Node.js
- Fedoraproject Fedora — versions 33
- Opensuse Leap — versions 15.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- support@hackerone.com (x_refsource_MISC, Vendor Advisory)
- support@hackerone.com (Permissions Required, x_refsource_MISC)
- support@hackerone.com (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- support@hackerone.com (x_refsource_CONFIRM, Third Party Advisory)
- support@hackerone.com (x_refsource_FEDORA, vendor-advisory)
- support@hackerone.com (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
Frequently asked questions
- What is CVE-2020-8201?
- CVE-2020-8201 is a high-severity vulnerability in Nodejs Node, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 7.4/10. Published 2020-09-18.
- How severe is CVE-2020-8201?
- High severity. CVSS v3 base score is 7.4 out of 10.
- Is CVE-2020-8201 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.