Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-q257-vv4p-fg92

Опубликовано: 09 нояб. 2018
Источник: github
Github: Прошло ревью
CVSS3: 7.5

Описание

Header Forgery in http-signature

Affected versions of http-signature contain a vulnerability which can allow an attacker in a privileged network position to modify header names and change the meaning of the request, without requiring an updated signature.

This problem occurs because vulnerable versions of http-signature sign the contents of headers, but not the header names.

Proof of Concept

Consider this to be the initial, untampered request:

POST /pay HTTP/1.1 Host: example.com Date: Thu, 05 Jan 2012 21:31:40 GMT X-Payment-Source: src@money.com X-Payment-Destination: dst@money.com Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-source x-payment-destination" MDyO5tSvin5...

And the request is intercepted and tampered as follows:

X-Payment-Source: dst@money.com // Emails switched X-Payment-Destination: src@money.com Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-destination x-payment-source" MDyO5tSvin5...

In the resulting responses, both requests would pass signature verification without issue.

src@money.com\n dst@money.com\n

Recommendation

Update to version 0.10.0 or higher.

Пакеты

Наименование

http-signature

npm
Затронутые версииВерсия исправления

< 0.10.0

0.10.0

EPSS

Процентиль: 37%
0.00161
Низкий

7.5 High

CVSS3

Дефекты

CWE-20

Связанные уязвимости

CVSS3: 7.5
redhat
больше 7 лет назад

Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.

CVSS3: 7.5
nvd
больше 7 лет назад

Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.

CVSS3: 7.5
debian
больше 7 лет назад

Http-signature is a "Reference implementation of Joyent's HTTP Signatu ...

EPSS

Процентиль: 37%
0.00161
Низкий

7.5 High

CVSS3

Дефекты

CWE-20