NetSight
IP …
high7.5

CVE-2021-22884

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”.

Impact

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.

Affected products

VendorProductAffected versions
NodejsNode.Js
from 10.0.0 before 10.24.0
from 12.0.0 before 12.21.0
from 14.0.0 before 14.16.0
from 15.0.0 before 15.10.0
FedoraprojectFedora
Versions 32, 33, 34
NetappActive Iq Unified Manager
All versions
NetappE-Series Performance Analyzer
All versions
NetappOncommand Insight
All versions
NetappOncommand Workflow Automation
All versions
NetappSnapcenter
All versions
OracleGraalvm
Versions 19.3.5, 20.3.1.2, 21.0.0.2
OracleJd Edwards Enterpriseone Tools
before 9.2.6.0
OracleMysql Cluster
through 8.0.25
OracleNosql Database
before 20.3
OraclePeoplesoft Enterprise Peopletools
Versions 8.58, 8.59

Weakness classification

CWE-350

References