SYNC-2021-031201 - HTTP Response Splitting

Abstract

The express package is vulnerable to HTTP Response Splitting. The redirect() function in the file response.js allows Carriage Return and Line Feed (CRLF) characters in the user input, which is then injected into the HTTP response. A remote attacker can exploit the vulnerability by crafting user input with the CRLF characters which will allow the attacker to set arbitrary HTTP response headers and control the body of the HTTP response. Likewise, any sensitive information, such as authentication tokens that are returned in the HTTP response sequentially after the injection point, will be accessible to the attacker.

The Oxygen Content Fusion product incorporates the express package as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

The application is vulnerable by using this component with NodeJS runtime versions less than 0.9.4. NodeJS runtime versions including and after 0.9.4 have built in response splitting protections, effectively remediating the issue at the runtime level.

Detail

SYNC-2021-031201

Severity: High

CVSS Score: 7.5

While there is no non-vulnerable version of this component the vulnerability was fixed at the runtime level, within NodeJS itself.

All versions of Oxygen Content Fusion are using a NodeJS version newer than 0.9.4.

Therefore, the Oxygen Content Fusion product is not affected by this vulnerability.