CVE-2021-22884

Katalog CVE

CVSS 7.5 · High EPSS 36,8%

Kerentanan Reliance on Reverse DNS Resolution for a Security-Critical Action pada nodejs node.js, fedoraproject fedora +11 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.

Rincian

Terbit di NVD

3 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action

EPSS (30 hari)

36,8% peluang dieksploitasi; lebih tinggi dari 98,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/ patch · release notes · advisory vendor
• https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/#node-js-inspector-dns-rebinding-vulnera... patch · release notes · advisory vendor
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf patch · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• https://hackerone.com/reports/1069487 exploit · issue tracking · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210416-0001/ advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210723-0001/ advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MT...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27...