Junglewise Threat Intelligence

CVE-2022-24822: Podium layout and proxy denial of service via Trailer header

CVE-2022-24822 · Severity: low · CVSS 3.1 · Published 2022-04-07

Vendors: npm.

Executive brief

Podium is a framework used to build micro frontends by combining different web components. A vulnerability in its proxy and layout modules allows a remote attacker to crash the server by sending a specially crafted web request. This results in a denial-of-service, making the website or application unavailable to legitimate users.

Technical details

A denial-of-service (DoS) vulnerability exists in @podium/proxy and @podium/layout due to an uncaught exception (CWE-248) when processing HTTP requests. An attacker can trigger this exception by including a 'Trailer' header in a request directed at proxy endpoints. Because the exception is not properly handled within the proxy logic, it causes the Node.js process to crash. The vulnerability is reachable over the network without authentication. The issue has been resolved by explicitly removing the Trailer header during proxying in @podium/proxy version 4.2.74 and updating the dependency in @podium/layout version 4.6.110.

Affected products

  • Podium @podium/layout < 4.6.110
  • Podium @podium/proxy < 4.2.74

Timeline

  • 2022-04-05: patched: Fixes released in @podium/layout v4.6.110 and @podium/proxy v4.2.74
  • 2022-04-06: advisory: GitHub Security Advisory published
  • 2022-04-07: disclosed: CVE-2022-24822 disclosed

References