PT-2020-21103 · Unknown · Http-Proxy

Published 2020-09-04 · Updated 2020-09-04

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions http-proxy versions prior to 1.18.1

Description The issue allows an HTTP request with a long body to trigger an unhandled exception, causing the proxy server to crash. This occurs when the proxy server sets headers in the proxy request using the proxyReq.setHeader function. An example of a curl request that can trigger this exception is: curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')".

Recommendations Upgrade to version 1.18.1 or later.

Fix

Incomplete List of Disallowed Inputs

Protection Mechanism Failure

Weakness Enumeration

CWE-184

CWE-693

Related Identifiers

GHSA-6X33-PW7P-HMPQ

Affected Products

Http-Proxy

References · 4

• https://osv.dev/vulnerability/GHSA-6x33-pw7p-hmpq · Vendor Advisory
• https://github.com/http-party/node-http-proxy/pull/1447/commits/4718119ffbe895aecd9be0d6430357d44b4c7fd3 · Note
• https://github.com/http-party/node-http-proxy/pull/1447/files · Note
• https://npmjs.com/advisories/1486 · Note