Kurz gesagt
- CVE-2017-16030 ist eine Schwachstelle (HOCH (CVSS 7.5)) in useragent (useragent project), useragent.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.1%, höher als bei 66.9% aller Schwachstellen.
- Abhilfe: auf 2.1.13 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| useragent | ≤ 2.1.12
| No fix yet |
| useragent npm | < 2.1.13
| 2.1.13
|
Description
Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed.
Proof of Concept
var useragent = require('useragent');
var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';
var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n';
console.log(useragent.parse(request));
Recommendation
Update to version 2.1.13 or later.
NVD description
Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free