CVE-2022-32212

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "4.*"
                },
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "5.*"
                },
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.*"
                },
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.*"
                },
                {
                    "introduced": "8.0"
                },
                {
                    "fixed": "8.*"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "fixed": "9.*"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "fixed": "10.*"
                },
                {
                    "introduced": "11.0"
                },
                {
                    "fixed": "11.*"
                },
                {
                    "introduced": "12.0"
                },
                {
                    "fixed": "12.*"
                },
                {
                    "introduced": "13.0"
                },
                {
                    "fixed": "13.*"
                },
                {
                    "introduced": "14.0"
                },
                {
                    "fixed": "14.20.1"
                },
                {
                    "introduced": "15.0"
                },
                {
                    "fixed": "15.*"
                },
                {
                    "introduced": "16.0"
                },
                {
                    "fixed": "16.17.1"
                },
                {
                    "introduced": "17.0"
                },
                {
                    "fixed": "17.*"
                },
                {
                    "introduced": "18.0"
                },
                {
                    "fixed": "18.9.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "hackerone",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32212.json",
    "cwe_ids": [
        "CWE-284"
    ]
}

References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type

GIT

Repo

https://github.com/nodejs/node

Events

Introduced

73aa21658dfa6a22c06451d080152b32b1f98dbe

Introduced

c1da528bc25c9cc5a8240a7b4f136f5968f6e113

Fixed

c11b8215bd6388854efcc9302a7383c8c63b8127

Introduced

7162e686b18d22b4385fa5c04274fb04dbd810c7

Introduced

40ecd5601193c316e62e9216e8a4259130686208

Fixed

6b06e89c7dfccec6792008302af1cee57649445c

Introduced

49a77a5a996a49e8cb728eed42e55a7c1a9eef6e

Fixed

0a18e136b4a1e860bb2befcbd1f78661ed5fb5e7

Database specific

{
    "extracted_events": [
        {
            "introduced": "14.0.0"
        },
        {
            "last_affected": "14.14.0"
        },
        {
            "introduced": "14.15.0"
        },
        {
            "fixed": "14.20.1"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "last_affected": "16.12.0"
        },
        {
            "introduced": "16.13.0"
        },
        {
            "fixed": "16.17.1"
        },
        {
            "introduced": "18.0.0"
        },
        {
            "fixed": "18.5.0"
        }
    ],
    "cpe": [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"
    ],
    "source": "CPE_RANGE"
}

Affected versions

v14.*

v14.15.0

v14.15.1

v14.15.2

v14.15.3

v14.15.4

v14.15.5

v14.16.0

v14.16.1

v14.17.0

v14.17.1

v14.17.2

v14.17.3

v14.17.4

v14.17.5

v14.17.6

v14.18.0

v14.18.1

v14.18.2

v14.18.3

v14.19.0

v14.19.1

v14.19.2

v14.19.3

v14.20.0

v16.*

v16.13.0

v16.13.1

v16.13.2

v16.14.0

v16.14.1

v16.14.2

v16.15.0

v16.15.1

v16.16.0

v16.17.0

v18.*

v18.0.0

v18.1.0

v18.2.0

v18.3.0

v18.4.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-32212.json"