CVE-2018-7160: Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding
8.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.77719%
CWE
Published
5/13/2022
Updated
10/9/2023
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
node-inspector | npm | >= 6.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from inadequate Host header validation in the inspector's WebSocket handshake process. The core issue was in message_complete_cb which didn't perform proper Host validation before the fix added IsAllowedHost checks. The header_value_cb's original implementation only looked for specific headers without maintaining full header context, making the Host validation incomplete. The commit e3950d1 added Host validation and proper header handling, indicating these were the missing security checks.