Executive brief
@commercial/ammo is a Node.js library that handles HTTP request parsing, including the Range header used for partial content requests. Versions before 2.1.1 crash when processing an invalid Range header, causing the entire application to shut down and denying service to all users.
Technical details
The vulnerability is an unhandled exception in the Range HTTP header parser. When a malformed Range header is sent, the parser throws an error that is not caught by the library, propagating up the call stack unchecked. The hapi framework does not expect this function to throw, so the exception crashes the process. An attacker can exploit this by sending a crafted HTTP request with an invalid Range header to any application using affected versions, causing immediate service termination if no global error handler is configured.
Affected products
- @commercial ammo before 2.1.1
Timeline
- 2020-09-04: disclosed
- 2020-09-04: patched: Fixed in version 2.1.1