CVE-2022-24822 (published 2022-04-06T18:15Z)

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74, an attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. `@podium/layout`, which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.`@podium/proxy`, which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable. It is not easily possible to work around this issue without upgrading.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/podium-lib/proxy
commit_details: repo_url: https://github.com/podium-lib/proxy
author: Richard Walker
author_date: 2022-04-05 11:14:03+02:00
msg: fix: remove trailer header if present when proxying
repository: repo_url: https://github.com/podium-lib/proxy
repo_name: podium-lib/proxy
description: Module for proxying HTTP requests from a layout server to a podlet server (or any remote destination)
repo_language: JavaScript
owner: podium-lib
file_changes: filename: proxy.js
change_type: ModificationType.MODIFY
diff: @@ -151,6 +151,9 @@ const PodiumProxy = class PodiumProxy {
             let errored = false;
 
             if (match) {
+                // eslint-disable-next-line no-param-reassign
+                delete incoming.request.headers.trailer;
+
                 // Turn matched uri parameters into an object of parameters
                 const params = {};
                 for (let i = 1; i < match.length; i += 1) {

programming_language: TypeScript
filename: proxying.js
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 'use strict';
 
 const { test } = require('tap');
+const { exec } = require('child_process');
 const {
     destinationObjectStream,
     HttpServer,
@@ -442,3 +443,57 @@ test('Proxying() - proxy to a non existing server - GET request will error - sho
 
     t.end();
 });
+
+test('Proxying() - trailer header - is not forwarded according to spec', async (t) => {
+    const server = new HttpServer();
+    server.request = (req, res) => {
+        t.ok(!req.headers.trailer, 'Trailer header should not be set');
+        res.statusCode = 200;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(
+            JSON.stringify({
+                method: req.method,
+                type: 'destination',
+                url: `http://${req.headers.host}${req.url}`,
+            }),
+        );
+    };
+
+    const serverAddr = await server.listen();
+
+    const proxy = new ProxyServer(
+        [
+            {
+                name: 'foo',
+                proxy: {
+                    a: `${serverAddr}/some/path`,
+                },
+                version: '1.0.0',
+                content: '/',
+            },
+        ],
+        { name: 'mylayout' },
+    );
+
+    const proxyAddr = await proxy.listen();
+
+    await new Promise((resolve, reject) => {
+        exec(
+            `curl -i -H 'Trailer: Krynos' -H 'User-Agent: Mozilla' '${proxyAddr}/layout/proxy/foo/a'`,
+            (error, stdoutput, stderror) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve({ stdout: stdoutput, stderr: stderror });
+            },
+        );
+    });
+
+    t.ok(true);
+
+    await proxy.close();
+    await server.close();
+
+    t.end();
+});

programming_language: TypeScript
repo_url: https://github.com/podium-lib/layout
commit_details: repo_url: https://github.com/podium-lib/layout
author: Richard Walker
author_date: 2022-04-05 14:10:03+02:00
msg: fix: update Proxy module to fix trailer header vulnerability
repository: repo_url: https://github.com/podium-lib/layout
repo_name: podium-lib/layout
description: Module for building a Podium layout server. A layout server composes multiple podlets into a layout resulting in a complete webpage.
repo_language: JavaScript
owner: podium-lib
file_changes: filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -39,7 +39,7 @@
     "@metrics/client": "2.5.0",
     "@podium/client": "4.5.22",
     "@podium/context": "4.1.74",
-    "@podium/proxy": "4.2.73",
+    "@podium/proxy": "4.2.74",
     "@podium/schemas": "4.1.32",
     "@podium/utils": "4.4.36",
     "abslog": "2.4.0",

programming_language: JavaScript