Описание
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Impact
What kind of vulnerability is it? Who is impacted?
SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. Spring Framework's own security patch (6e97587) validates these same fields (id, event) for the same reason.
Actual impact:
- Event spoofing: Attacker forges SSE events with arbitrary
event:types, causing client-sideEventSource.addEventListener()callbacks to fire for wrong event types. - Data injection: Attacker injects arbitrary
data:payloads, potentially triggering XSS if the client renders SSE data as HTML without sanitization. - Reconnection corruption: Attacker injects
id:fields, corrupting theLast-Event-IDheader on reconnection, causing the client to miss or replay events. - Attack precondition: Requires the developer to map user-influenced data to the
typeoridfields of SSE messages. Direct HTTP request input does not reach these fields without developer code bridging the gap.
Patches
Has the problem been patched? What versions should users upgrade to?
Patched in @nestjs/core@11.1.18
Пакеты
@nestjs/core
<= 11.1.17
11.1.18
Связанные уязвимости
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. This vulnerability is fixed in 11.1.18.
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. This vulnerability is fixed in 11.1.18.