Loading vulnerability…
Node.js Inspector DNS Rebinding via Invalid Octal IP Addresses
CVE-2022-43548 is a DNS rebinding protection bypass in the Node.js inspector. Insufficient validation in IsIPAddress causes IsAllowedHost to accept invalid IP-address representations, specifically octal forms that browsers such as Firefox may resolve through DNS. This discrepancy permits DNS rebinding against an active inspector session and can enable arbitrary code execution. The vulnerability affects Node.js releases preceding 14.21.1, 16.18.1, 18.12.1, and 19.0.1 in their respective release branches and completes an incomplete fix for CVE-2022-32212. Older distribution-maintained branches also required security updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary code execution in the context of the affected Node.js process, potentially compromising confidentiality, integrity, and availability. Consequences include disclosure of sensitive information, unauthorized addition or modification of data, and denial of service. The extent of compromise depends on the privileges and resources available to the process.
If you can’t patch tonight, do this now.
Disable Node.js inspector functionality when it is not required, including inspector sessions started by development tools. If debugging is necessary, restrict inspector access to trusted debugging clients and prevent untrusted browser-originated connections. Restricting remote network exposure alone may not eliminate browser-mediated DNS rebinding against a locally reachable inspector.
Patch, then assume compromise.
Upgrade to Node.js 14.21.1, 16.18.1, 18.12.1, or 19.0.1 or a later security-fixed release in the applicable branch. For distribution-managed installations, apply the vendor's security update; backported fixes may retain older upstream version numbers. Debian fixed the issue in 10.24.0~dfsg-1~deb10u3 for Debian 10 and 12.22.12~dfsg-1~deb11u3 for Debian 11. Products embedding Node.js should receive the relevant product-vendor update incorporating the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.