CVE-2022-43548 Command injection in Node
An attacker can execute arbitrary OS commands via a rebinding attack due to insufficient IP validation in Node.js DNS resolution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43548?
CVE-2022-43548 is a high-severity command injection vulnerability in Debian Debian Linux, published on 5 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
Weakness: CWE-78
Which versions are affected by CVE-2022-43548?
2 open source packages ship an affected version, including node and node-min. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | From 14.0.0 | 14.14.1, 14.21.1, 16.12.1, 16.18.1, 18.11.1, 18.12.1, 19.0.1 |
node-min Bitnami | From 14.0.0 | 14.14.1, 14.21.1, 16.12.1, 16.18.1, 18.11.1, 18.12.1, 19.0.1 |
Linux distribution packages (38)
nodejs10 SUSE:Enterprise Storage 6 | All versions | 10.24.1-150000.1.53.1 |
nodejs10 SUSE:Enterprise Storage 7 | All versions | 10.24.1-150000.1.53.1 |
nodejs12 SUSE:Enterprise Storage 7 | All versions | 12.22.12-150200.4.41.2 |
nodejs14 SUSE:Enterprise Storage 7 | All versions | 14.21.1-150200.15.40.2 |
nodejs10 SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 10.24.1-150000.1.53.1 |
nodejs10 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 10.24.1-150000.1.53.1 |
nodejs10 SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 10.24.1-150000.1.53.1 |
nodejs12 SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 12.22.12-150200.4.41.2 |
nodejs14 SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 14.21.1-150200.15.40.2 |
nodejs10 SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 10.24.1-150000.1.53.1 |
nodejs12 SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 12.22.12-150200.4.41.2 |
nodejs14 SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 14.21.1-150200.15.40.2 |
nodejs10 SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 10.24.1-150000.1.53.1 |
nodejs10 SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 10.24.1-150000.1.53.1 |
nodejs12 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 12.22.12-1.57.1 |
nodejs14 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 14.21.1-6.37.1 |
nodejs16 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 16.18.1-8.17.1 |
nodejs12 SUSE:Linux Enterprise Module for Web and Scripting 15 SP3 | All versions | 12.22.12-150200.4.41.2 |
nodejs14 SUSE:Linux Enterprise Module for Web and Scripting 15 SP3 | All versions | 14.21.1-150200.15.40.2 |
nodejs16 SUSE:Linux Enterprise Module for Web and Scripting 15 SP3 | All versions | 16.18.1-150300.7.15.1 |
nodejs16 SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | All versions | 16.18.1-150400.3.12.1 |
nodejs10 SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 10.24.1-150000.1.53.1 |
nodejs10 SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 10.24.1-150000.1.53.1 |
nodejs10 SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 10.24.1-150000.1.53.1 |
nodejs12 SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 12.22.12-150200.4.41.2 |
nodejs14 SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 14.21.1-150200.15.40.2 |
nodejs10 SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 10.24.1-150000.1.53.1 |
nodejs12 SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 12.22.12-150200.4.41.2 |
nodejs14 SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 14.21.1-150200.15.40.2 |
nodejs10 SUSE:Linux Enterprise Server 15-LTSS | All versions | 10.24.1-150000.1.53.1 |
nodejs10 SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 10.24.1-150000.1.53.1 |
nodejs10 SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 10.24.1-150000.1.53.1 |
nodejs10 SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 10.24.1-150000.1.53.1 |
nodejs12 SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 12.22.12-150200.4.41.2 |
nodejs14 SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 14.21.1-150200.15.40.2 |
nodejs10 SUSE:Manager Proxy 4.1 | All versions | 10.24.1-150000.1.53.1 |
nodejs12 SUSE:Manager Proxy 4.1 | All versions | 12.22.12-150200.4.41.2 |
nodejs14 SUSE:Manager Proxy 4.1 | All versions | 14.21.1-150200.15.40.2 |
Products include Debian Debian Linux, Nodejs Node.js.
How do I fix CVE-2022-43548?
Upgrade node to a fixed version for your release line: 14.14.1, 14.21.1, 16.12.1 or 16.18.1.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-43548 being exploited?
There is no known exploitation of CVE-2022-43548 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-43548, AZL-11577, BIT-node-2022-43548, BIT-node-min-2022-43548, CLEANSTART-2026-LB31103, CLEANSTART-2026-UJ52999 and 16 more.