Listen to this Post
How the CVE Works
CVE-2023-30588 is an HTTP request smuggling vulnerability in Node.js due to improper handling of `Transfer-Encoding` and `Content-Length` headers. Attackers can craft malformed HTTP requests with conflicting headers, leading to request smuggling. This allows bypassing security controls, cache poisoning, or session hijacking. Node.js fails to normalize chunked encoding, enabling desync attacks where a front-end and back-end server interpret requests differently. The vulnerability stems from the `llhttp` parser not enforcing strict header validation, allowing smuggled requests to reach unauthorized endpoints.
DailyCVE Form
Platform: Node.js
Version: <18.16.1, <20.3.1
Vulnerability: HTTP Request Smuggling
Severity: Critical
Date: 2023-06-22
Prediction: Patch expected by 2023-07-15
What Undercode Say
Check Node.js version node -v Exploit PoC (simplified) curl -H "Transfer-Encoding: chunked" -H "Content-Length: 0" http://target Mitigation test npm update node
How Exploit
- Craft conflicting `Transfer-Encoding` and `Content-Length` headers.
- Send malformed requests to trigger desync.
- Bypass authentication or poison caches.
Protection from this CVE
- Upgrade to Node.js ≥18.16.1 or ≥20.3.1.
- Use reverse proxies with strict HTTP parsing.
- Filter malformed headers via WAF.
Impact
- Unauthorized data access.
- Cache poisoning.
- Session hijacking.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
