En bref
- CVE-2017-16030 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant useragent (useragent project), useragent.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.1%, plus élevée que 66.9% des vulnérabilités.
- Correctif : mettre à jour vers 2.1.13 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| useragent | ≤ 2.1.12
| No fix yet |
| useragent npm | < 2.1.13
| 2.1.13
|
Description
Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed.
Proof of Concept
var useragent = require('useragent');
var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';
var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n';
console.log(useragent.parse(request));
Recommendation
Update to version 2.1.13 or later.
NVD description
Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free