CVE-2021-22884 | Vulnetix

CVE-2021-22884 PUBLISHED CVSS 7.5 HIGH

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.

EPSS 36.84% · 98.5th percentile

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

36.84%

98.5th percentile

Affected Products

Vendor	Product	Versions
Bitnami	node-min	12.0.0, 14.0.0, 15.0.0
Bitnami	node	15.0.0, 14.0.0, 15.0.0
Bitnami	node-min	15.0.0, 10.0.0, 12.0.0
Bitnami	node	10.0.0, 12.0.0, 15.0.0

Timeline

CVE Published
Feb 23, 2021 PoC Published
Apr 14, 2021 EPSS Score
Jun 19, 2021 EPSS Score
Jun 24, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Dec 28, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Apr 1, 2022 EPSS Score
May 2, 2022 EPSS Score
Jul 4, 2022 EPSS Score

References

Open in Interactive Console →