PT-2021-19437 · Node.Js+1 · Node.Js+1

Published 2021-04-22 · Updated 2022-04-18 · CVE-2021-31597

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions xmlhttprequest-ssl versions prior to 1.6.1

Description The issue concerns the disabling of SSL certificate validation by default in the xmlhttprequest-ssl package for Node.js. This occurs because the rejectUnauthorized property, when it exists but is undefined, is considered false within the https.request function of Node.js, resulting in no certificate being rejected.

Recommendations For versions prior to 1.6.1, update to version 1.6.1 or later to enable proper SSL certificate validation. As a temporary workaround, consider setting the rejectUnauthorized property to true to ensure certificate validation.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

AZL-45213

CVE-2021-31597

GHSA-72MH-269X-7MH5

Affected Products

Node.Js

Xmlhttprequest-Ssl

References · 15

• 🔥 https://people.kingsds.network/wesgarland/xmlhttprequest-ssl-vuln.txt · Exploit
• https://github.com/mjwwit/node-XMLHttpRequest/commit/bf53329b61ca6afc5d28f6b8d2dc2e3ca740a9b2 · Patch
• https://github.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-31597 · Security Note
• https://osv.dev/vulnerability/GHSA-72mh-269x-7mh5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31597 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-31597 · Security Note
• https://ubuntu.com/security/CVE-2021-31597 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45213 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-31597 · Vendor Advisory
• https://t.me/cvenotify/13568 · Telegram Post
• https://t.me/true_secator/2858 · Telegram Post
• https://security.netapp.com/advisory/ntap-20210618-0004 · Note
• https://t.me/cvenotify/14661 · Telegram Post
• https://t.me/cvenotify/16530 · Telegram Post