PT-2024-22139 · Unknown+1 · Tomp Bare Server+1

Hackermondev · Published 2024-03-05 · Updated 2026-01-02 · CVE-2024-27922

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOMP Bare Server versions prior to 2.0.2

Description A vulnerability in TOMP Bare Server relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may vary depending on the specific usage of the package but it can potentially affect any system where this package is in use.

Recommendations For versions prior to 2.0.2, upgrade to version 2.0.2 as soon as possible to patch the vulnerability. As a temporary measure, consider restricting the use of the @tomphttp/bare-server-node package until the upgrade is applied.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2024-27922

GHSA-86FC-F9GR-V533

Affected Products

@Tomphttp/Bare-Server-Node

Tomp Bare Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27922.json · Exploit
• https://github.com/tomphttp/bare-server-node/security/advisories/GHSA-86fc-f9gr-v533 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-86fc-f9gr-v533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27922 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27922 · Vendor Advisory
• https://github.com/tomphttp/bare-server-node · Note
• https://twitter.com/VulmonFeeds/status/1770716132602675547 · Twitter Post
• https://twitter.com/cracbot/status/1771321512403853547 · Twitter Post
• https://t.me/cveNotify/147498 · Telegram Post