CVE-2022-25906: is-http2 vulnerable to Improper Input Validation
7.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.27687%
CWE
Published
2/1/2023
Updated
8/8/2023
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| is-http2 | npm | <= 1.2.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from the isH2 function's use of exec() with unvalidated user inputs:
- The 'openssl' parameter from options is directly interpolated into shell commands without sanitization
- The URL parameter is used in command construction after minimal formatting checks
- The PoC demonstrates injection via the openssl parameter (e.g., {openssl: "touch JHU"})
- The code shows clear command string concatenation (lines 23-78) without proper escaping or sandboxing
- CWE-78 (OS Command Injection) is explicitly referenced in the advisory