CVE-2020-8201

2020-09-1800:00:00

ubuntu.com

node.js

http desync

vulnerability

cve-2020-8201

session hijacking

clickjacking

http header vulnerability

carrier-return symbols

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.003

Percentile

71.6%

JSON

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync
attacks and deliver malicious payloads to unsuspecting users. The payloads
can be crafted by an attacker to hijack user sessions, poison cookies,
perform clickjacking, and a multitude of other attacks depending on the
architecture of the underlying system. The attack was possible due to a bug
in processing of carrier-return symbols in the HTTP header names.