Executive brief
The request HTTP client library for Node.js can leak local system memory to remote servers when processing multipart requests with numeric body values. An attacker can craft a malicious request that causes the library to allocate and send a buffer of arbitrary size containing uninitialized memory, potentially exposing sensitive data from the server's RAM to the attacker.
Technical details
The vulnerability is a CWE-201 information disclosure flaw in request's multipart request handling. When a multipart request body parameter is set to a number (instead of a string or buffer), the library allocates a buffer of that size and sends it as-is to the remote server without clearing it first. This uninitialized memory may contain sensitive data from the server process. The attack requires only a crafted HTTP request; no authentication or user interaction is needed. An attacker can retrieve up to several hundred bytes of system memory with each request. The fix was released in version 2.68.0.
Affected products
- request request 2.2.6 to 2.67.x
Timeline
- 2018-11-09: disclosed
- 2017: patched: Fix released in version 2.68.0