SYNC-2021-031201 - HTTP Response Splitting
Severity: Low2021-03-12
Abstract
The express package is vulnerable to HTTP Response Splitting. The redirect() function in the file response.js allows Carriage Return and Line Feed (CRLF) characters in the user input, which is then injected into the HTTP response. A remote attacker can exploit the vulnerability by crafting user input with the CRLF characters which will allow the attacker to set arbitrary HTTP response headers and control the body of the HTTP response. Likewise, any sensitive information, such as authentication tokens that are returned in the HTTP response sequentially after the injection point, will be accessible to the attacker.
The Oxygen Content Fusion product incorporates the express package as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.
Affected Products/Versions
Product | Severity | Fixed Release Availability |
Oxygen Content Fusion 4.0 and older | Low | N/A |
Mitigation
The application is vulnerable by using this component with NodeJS runtime versions less than 0.9.4. NodeJS runtime versions including and after 0.9.4 have built in response splitting protections, effectively remediating the issue at the runtime level.
Detail
SYNC-2021-031201
Severity: High
CVSS Score: 7.5
While there is no non-vulnerable version of this component the vulnerability was fixed at the runtime level, within NodeJS itself.
All versions of Oxygen Content Fusion are using a NodeJS version newer than 0.9.4.
Therefore, the Oxygen Content Fusion product is not affected by this vulnerability.