GHSA-wq4c-wm6x-jw44

Suggest an improvement
Source
https://github.com/advisories/GHSA-wq4c-wm6x-jw44
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wq4c-wm6x-jw44/GHSA-wq4c-wm6x-jw44.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wq4c-wm6x-jw44
Aliases
Withdrawn
2023-10-09T00:42:54Z
Published
2022-05-13T01:08:23Z
Modified
2026-09-10T03:49:43Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding
Details

Withdrawn Advisory

This advisory has been withdrawn because this vulnerability affects inspector code in https://github.com/nodejs/node, not the legacy debugger at https://github.com/node-inspector/node-inspector. https://github.com/nodejs/node is not in a supported ecosystem.

Original Description

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.

Database specific 
{
    "cwe_ids":  [
        "CWE-290"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-07-20T22:39:06Z",
    "nvd_published_at":  "2018-05-17T14:29:00Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / node-inspector

Package

Name
node-inspector
View open source insights on deps.dev
Purl
pkg:npm/node-inspector

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wq4c-wm6x-jw44/GHSA-wq4c-wm6x-jw44.json"