Executive brief
Node.js includes a built-in debugger/inspector interface that allows developers to remotely inspect and debug running applications. An attacker could exploit a DNS rebinding attack to trick a web browser into connecting to the Node.js inspector on a local machine and gain full code execution. This vulnerability was withdrawn because it actually affects Node.js itself (which is not in a supported GitHub advisory ecosystem), not the separate node-inspector third-party tool.
Technical details
The vulnerability is a DNS rebinding attack (CWE-290) affecting the Node.js inspector in versions 6.x and later. An attacker hosts a malicious website that manipulates DNS responses to bypass same-origin-policy checks in the victim's web browser, allowing HTTP connections to localhost or local network hosts. If a Node.js process with an active debug port is running, the attacker can connect to the inspector as a debugger and achieve arbitrary code execution. The fix involves validating the Host header in inspector connections to prevent rebinding attacks. This advisory was withdrawn in October 2023 because the vulnerability affects Node.js core (not in a supported GitHub ecosystem) rather than the separate node-inspector package.
Affected products
- OpenJS Foundation Node.js 6.x and later
Timeline
- 2018-05-17: disclosed
- 2018-05: patched: Fix via Host header validation in inspector
- 2023-10-09: other: Advisory withdrawn - vulnerability found to affect Node.js core, not node-inspector package