Vulnerability · Published Sep 18, 2020 · Assigned by hackerone

CVE-2020-8201

High 7.4

In plain English

A high-severity security flaw in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.3% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.4High

Exploit odds (30 days)5.3%top 7.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2023+d2377ea3	ALSA-2020:4272
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2047+b07ac28e	ALSA-2020:4272
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2020:4272
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2020:4272
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2020:4272
Alpine:v3.20	nodejs	12.18.4-r0	ALPINE-CVE-2020-8201
Alpine:v3.21	nodejs	12.18.4-r0	ALPINE-CVE-2020-8201
Alpine:v3.22	nodejs	12.18.4-r0	ALPINE-CVE-2020-8201
Alpine:v3.23	nodejs	12.18.4-r0	ALPINE-CVE-2020-8201
Alpine:v3.24	nodejs	12.18.4-r0	ALPINE-CVE-2020-8201
Alpine:v3.20	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8201
Alpine:v3.21	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8201
Alpine:v3.22	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8201
Alpine:v3.23	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8201
Alpine:v3.24	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8201
Debian:12	nodejs	12.18.4~dfsg-1	DEBIAN-CVE-2020-8201
Debian:13	nodejs	12.18.4~dfsg-1	DEBIAN-CVE-2020-8201
Debian:14	nodejs	12.18.4~dfsg-1	DEBIAN-CVE-2020-8201
Rocky Linux:8	nodejs-nodemon	0:1.18.3-1.module+el8.3.0+101+f84c7154	RLSA-2020:4272
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2020:4272
Ubuntu:22.04:LTS	nodejs	12.22.9~dfsg-1ubuntu3	UBUNTU-CVE-2020-8201

Affected products (as reported)

Vendor	Product	Versions
NodeJS	Node	4.0 – before 4.5.0 – before 5.6.0 – before 6.7.0 – before 7.8.0 – before 8.9.0 – before 9.11.0 – before 11.*12.0 – before 12.18.4

Weakness: CWE-444

References

https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/ x_refsource_MISC
https://hackerone.com/reports/922597 x_refsource_MISC
openSUSE-SU-2020:1616 vendor-advisory, x_refsource_SUSE
https://security.netapp.com/advisory/ntap-20201009-0004/ x_refsource_CONFIRM
FEDORA-2020-43d5a372fc vendor-advisory, x_refsource_FEDORA
GLSA-202101-07 vendor-advisory, x_refsource_GENTOO