Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2024-27922

CVE-2024-27922:
HTTP Handling Vulnerability in the Bare server

9.8

CVSS Score

Basic Information

CVE ID
CVE-2024-27922
GHSA ID
GHSA-86fc-f9gr-v533
EPSS Score
-
CWE
CWE-444
Published
3/5/2024
Updated
3/21/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
@tomphttp/bare-server-nodenpm< 2.0.22.0.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The provided vulnerability information indicates an HTTP request smuggling issue (CWE-444) in the @tomphttp/bare-server-node package, but no specific code examples, commit diffs, or function names are disclosed in the advisory materials. While the vulnerability likely relates to HTTP header parsing and request handling logic (e.g., improper handling of Content-Length/Transfer-Encoding headers or request normalization), the lack of technical details about the implementation makes it impossible to identify specific vulnerable functions with high confidence. The patched version (2.0.2) would be required to perform a differential analysis to locate the exact vulnerable code paths.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is vuln*r**ility r*l*t*s to ins**ur* **n*lin* o* *TTP r*qu*sts *y t** @tomp*ttp/**r*-s*rv*r-no** p**k***. T*is *l*w pot*nti*lly *xpos*s t** us*rs o* t** p**k*** to m*nipul*tion o* t**ir w** tr***i*. T** imp**t m*y v*ry **p*n*in* on t** s

Reasoning

T** provi*** vuln*r**ility in*orm*tion in*i**t*s *n *TTP r*qu*st smu**lin* issu* (*W*-***) in t** @tomp*ttp/**r*-s*rv*r-no** p**k***, *ut no sp**i*i* *o** *x*mpl*s, *ommit *i**s, or *un*tion n*m*s *r* *is*los** in t** **visory m*t*ri*ls. W*il* t** vu