CVE-2022-24822 Denial of Service in @podium/layout and @podium/proxy

What is CVE-2022-24822?

CVE-2022-24822 is a high-severity denial of service vulnerability in podium-lib proxy, published on 6 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74, an attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. `@podium/layout`, which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.`@podium/proxy`, which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable. It is not easily possible to work around this issue without upgrading.

Weakness: CWE-248

Which versions are affected by CVE-2022-24822?

4 open source packages ship an affected version, including @podium/proxy and @podium/layout. It affects 2 products.

Products include Finn Podium Layout, Finn Podium Proxy.

How do I fix CVE-2022-24822?

Upgrade @podium/proxy to 4.2.74 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-24822 being exploited?

There is no known exploitation of CVE-2022-24822 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3hjg-vc7r-rcrw.