Listen to this Post
How the CVE Works
CVE-2023-23936 is an HTTP request smuggling vulnerability in Node.js due to improper parsing of chunked transfer encoding headers. Attackers can exploit this by sending malformed HTTP requests with conflicting `Content-Length` and `Transfer-Encoding` headers. Node.js incorrectly processes these headers, leading to request smuggling where a single request is interpreted as multiple requests by the backend server. This allows attackers to bypass security controls, hijack sessions, or poison caches. The issue stems from inconsistent handling of chunked data in the `http` module, enabling attackers to manipulate request boundaries.
DailyCVE Form
Platform: Node.js
Version: <18.2.0
Vulnerability: HTTP Request Smuggling
Severity: Critical
Date: 2023-02-16
Prediction: Patch by 2023-03-10
What Undercode Say
npm audit fix --force node -v Check version curl -H "Transfer-Encoding: chunked" -d "malformed_data" http://target
How Exploit
- Craft conflicting `Content-Length` and `Transfer-Encoding` headers.
- Send malformed chunked data to trigger smuggling.
- Bypass authentication or poison cache.
Protection from this CVE
- Upgrade to Node.js ≥18.2.0.
- Use reverse proxies with strict HTTP parsing.
- Monitor for anomalous HTTP traffic.
Impact
- Session hijacking.
- Cache poisoning.
- Unauthorized data access.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
