Listen to this Post
The request-filtering-agent npm package provides HTTP and HTTPS agents designed to block requests to private IP addresses, a common security control in applications that fetch user-supplied URLs. The vulnerability, tracked as CVE-2024-45390, affects versions 3.2.0 and earlier of the package. The core issue lies in how the agent implements its blocking mechanism within the createConnection method. When a request is made to a literal private IP address, such as the cloud metadata endpoint at 169.254.169.254 or localhost at 127.0.0.1, the agent’s code performs a synchronous throw of an Error object instead of handling the denial asynchronously. Node.js’s http.request and http.get functions expect the createConnection method to emit an error asynchronously via the returned socket or the provided callback. A synchronous throw from within createConnection bypasses the normal error emission path entirely, escaping any error listeners attached to the request object, such as req.on(‘error’, …). As a result, the thrown exception propagates up the call stack as an uncaught exception, which by default crashes the Node.js process. This creates a full Denial of Service condition. The vulnerability is particularly dangerous because the asymmetry in handling different inputs confirms the defect: hostnames that resolve to private IPs, such as localhost, are handled through an asynchronous DNS lookup path and correctly emit an error event, while literal private IP addresses trigger the synchronous throw. An attacker who can influence the target hostname of an HTTP request made by an application using this package can reliably crash that application by supplying a literal private IP address, even if the application performs pre-validation checks. The fix involves modifying the createConnection method to call the error callback asynchronously or to use process.nextTick to destroy the socket with the error, allowing the request’s error event to be handled properly.
DailyCVE Form:
Platform: Node.js
Version: <= 3.2.0
Vulnerability: Synchronous Throw Crash
Severity: Medium
date: 2024-09-10
Prediction: Already patched
What Undercode Say:
Analytics:
npm list request-filtering-agent
const http = require('http');
const { RequestFilteringHttpAgent } = require('request-filtering-agent');
const agent = new RequestFilteringHttpAgent();
process.on('uncaughtException', e => {
console.log('CRASH:', e.message);
});
const req = http.get({ hostname: '169.254.169.254', port: 80, agent });
req.on('error', e => { });
How Exploit: (Educational Purposes!)
const http = require('http');
const { RequestFilteringHttpAgent } = require('request-filtering-agent');
const agent = new RequestFilteringHttpAgent();
const req = http.get({ hostname: '169.254.169.254', port: 80, agent });
req.on('error', e => { });
Protection: from this CVE
- Upgrade to request-filtering-agent version 3.2.1 or later
- Use async callback: `callback(error)` in createConnection
- Use `process.nextTick(() => socket.destroy(error))`
Impact:
- Full Denial of Service
- Node.js process crash
- Unhandled exception
- Attacker-triggered via literal private IP hostname
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
