CVE-2018-7160 Server-side request forgery in Node.js
Attackers can exploit DNS rebinding to access the Node.js inspector and execute arbitrary code if the debug port is active.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-7160?
CVE-2018-7160 is a high-severity server-side request forgery vulnerability in Nodejs Node.js, published on 17 May 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
Which versions are affected by CVE-2018-7160?
It affects 1 product.
Products include Nodejs Node.js.
How do I fix CVE-2018-7160?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2018-7160 being exploited?
There is no known exploitation of CVE-2018-7160 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as ALPINE-CVE-2018-7160, CLEANSTART-2026-EN95904, CLEANSTART-2026-YQ27190, DEBIAN-CVE-2018-7160, UBUNTU-CVE-2018-7160.