The version of Node.js installed on the remote host is prior to 14.20.0, 16.16.0, 18.5.0. It is, therefore, affected by multiple vulnerabilities as referenced in the July 7th 2022 Security Releases advisory.

  - The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This     can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2022-32213 after     publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts:
    (CVE-2022-32213)

  - The llhttp parser in the http module does not strictly use the CRLF sequence to delimit HTTP requests.
    This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2022-32214 after     publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts:
    (CVE-2022-32214)

  - The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This     can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2022-32215 after     publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts:
    (CVE-2022-32215)

  - The IsAllowedHost check can easily be bypassed because IsIPAddress does not properly check if an IP     address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided),     browsers (such as Firefox) will make DNS requests to the DNS server, providing a vector for an attacker-     controlled DNS server or a MITM who can spoof DNS responses to perform a rebinding attack and hence     connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of     CVE-2021-22884. More details will be available at CVE-2022-32212 after publication. Thank you to Axel     Chong for reporting this vulnerability. Impacts: (CVE-2022-32212)

  - This vulnerability can be exploited if the victim has the following dependencies on Windows machine:
    Whenever the above conditions are present, node.exe will search for providers.dll in the current user     directory. After that, node.exe will try to search for providers.dll by the DLL Search Order in Windows.
    It is possible for an attacker to place the malicious file providers.dll under a variety of paths and     exploit this vulnerability. More details will be available at CVE-2022-32223 after publication. Thank you     to Yakir Kadkoda from Aqua Security for reporting this vulnerability. Impacts: Note: Node.js can use an     OpenSSL configuration file by specifying the environment variable OPENSSL_CONF, or using the command line     option --openssl-conf, and if none of those are specified will default to reading the default OpenSSL     configuration file openssl.cnf. Node.js will only read a section that is by default named nodejs_conf. If     your installation was using the default openssl.cnf file and is affected by this breaking change you can     fall back to the previous behavior by: (CVE-2022-32223)

  - When Node.js starts on linux based systems, it attempts to read     /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf, which ordinarily doesn't exist. On     some shared systems an attacker may be able create this file and therefore affect the default OpenSSL     configuration for other users. Thank you to Michael Scovetta from the OpenSSF Alpha-Omega project for     reporting this vulnerability. Impacts: (CVE-2022-32222)

  - AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt     the entirety of the data under some circumstances.  This could reveal sixteen bytes of data that was     preexisting in the memory that wasn't written.  In the special case of in place encryption, sixteen     bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS     and DTLS, they are both unaffected. Impacts: (CVE-2022-2097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Node.js 14.x < 14.20.0 / 16.x < 16.16.0 / 18.x < 18.5.0 Multiple Vulnerabilities (July 7th 2022 Security Releases).

high Nessus Plugin ID 165634

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.7 Jan 9, 2024, 11:15 AM Detection (Improved detection of OS managed installs) Plugin Feed: 202401091115
Version 1.6 Oct 10, 2023, 4:16 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202310101616
Version 1.5 Sep 11, 2023, 8:03 PM Plugin requirements (added Linux node.js detection as a dependency) Plugin Feed: 202309112003
Version 1.4 Mar 23, 2023, 4:25 PM CVSS metrics ("CVSSv3 score" changed from "9.1" to "8.1". "CVSSv3 score" changed from "9.1" to "8.1". "CVSSv3 score" changed from "9.1" to "8.1". "CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" to "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H". "CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" to "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (changed from "CVE-2022-32215" to "CVE-2022-32212") Plugin Feed: 202303231625
Version 1.3 Nov 14, 2022, 9:03 PM IAVM reference Plugin Feed: 202211142103