Junglewise Threat Intelligence

CVE-2017-16026: request remote memory exposure in multipart handling

CVE-2017-16026 · Severity: low · CVSS 3 · Published 2018-11-09

Technologies: Request.

Executive brief

The request HTTP client library for Node.js can leak local system memory to remote servers when processing multipart requests with numeric body values. An attacker can craft a malicious request that causes the library to allocate and send a buffer of arbitrary size containing uninitialized memory, potentially exposing sensitive data from the server's RAM to the attacker.

Technical details

The vulnerability is a CWE-201 information disclosure flaw in request's multipart request handling. When a multipart request body parameter is set to a number (instead of a string or buffer), the library allocates a buffer of that size and sends it as-is to the remote server without clearing it first. This uninitialized memory may contain sensitive data from the server process. The attack requires only a crafted HTTP request; no authentication or user interaction is needed. An attacker can retrieve up to several hundred bytes of system memory with each request. The fix was released in version 2.68.0.

Affected products

  • request request 2.2.6 to 2.67.x

Timeline

  • 2018-11-09: disclosed
  • 2017: patched: Fix released in version 2.68.0

References