CVE-2020-7764 (published 2020-11-08T16:15Z)

This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-444
cwe_name: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
extended_description: 
	   HTTP requests or responses ("messages") can be
	   malformed or unexpected in ways that cause web servers or
	   clients to interpret the messages in different ways than
	   intermediary HTTP agents such as load balancers, reverse
	   proxies, web caching proxies, application firewalls,
	   etc. For example, an adversary may be able to add duplicate
	   or different header fields that a client or server might
	   interpret as one set of messages, whereas the intermediary
	   might interpret the same sequence of bytes as a different
	   set of messages. For example, discrepancies can arise in
	   how to handle duplicate headers like two Transfer-encoding
	   (TE) or two Content-length (CL), or the malicious HTTP
	   message will have different headers for TE and
	   CL.
	   The inconsistent parsing and interpretation of messages
	   can allow the adversary to "smuggle" a message to the
	   client/server without the intermediary being aware of it.
	   This weakness is usually the result of the usage
	   of outdated or incompatible HTTP protocol versions in the
	   HTTP agents.
         
         

Fix information:
repo_url: https://github.com/delvedor/find-my-way
commit_details: repo_url: https://github.com/delvedor/find-my-way
author: Tomas Della Vedova
author_date: 2020-11-06 18:30:04+01:00
msg: Enable versioning on demand (#172)
repository: repo_url: https://github.com/delvedor/find-my-way
repo_name: delvedor/find-my-way
description: A crazy fast HTTP router
repo_language: JavaScript
owner: delvedor
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -144,7 +144,9 @@ router.on('GET', '/example', (req, res, params, store) => {
 
 ##### Versioned routes
 
-If needed you can provide a `version` option, which will allow you to declare multiple versions of the same route.
+If needed you can provide a `version` option, which will allow you to declare multiple versions of the same route. If you never configure a versioned route, the `'Accept-Version'` header will be ignored.
+
+Remember to set a [Vary](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Vary) header in your responses with the value you are using for deifning the versioning (e.g.: 'Accept-Version'), to prevent cache poisoning attacks. You can also configure this as part your Proxy/CDN.
 
 ###### default
 <a name="semver"></a>

programming_language: Markdown
filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -51,7 +51,7 @@ function Router (opts) {
   this.ignoreTrailingSlash = opts.ignoreTrailingSlash || false
   this.maxParamLength = opts.maxParamLength || 100
   this.allowUnsafeRegex = opts.allowUnsafeRegex || false
-  this.versioning = opts.versioning || acceptVersionStrategy
+  this.versioning = opts.versioning || acceptVersionStrategy(false)
   this.trees = {}
   this.routes = []
 }
@@ -111,6 +111,9 @@ Router.prototype._on = function _on (method, path, opts, handler, store) {
   })
 
   const version = opts.version
+  if (version != null && this.versioning.disabled) {
+    this.versioning = acceptVersionStrategy(true)
+  }
 
   for (var i = 0, len = path.length; i < len; i++) {
     // search for parametric or wildcard routes

programming_language: JavaScript
filename: accept-version.js
change_type: ModificationType.MODIFY
diff: @@ -2,9 +2,20 @@
 
 const SemVerStore = require('semver-store')
 
-module.exports = {
-  storage: SemVerStore,
-  deriveVersion: function (req, ctx) {
-    return req.headers['accept-version']
+function build (enabled) {
+  if (enabled) {
+    return {
+      storage: SemVerStore,
+      deriveVersion: function (req, ctx) {
+        return req.headers['accept-version']
+      }
+    }
+  }
+  return {
+    storage: SemVerStore,
+    deriveVersion: function (req, ctx) {},
+    disabled: true
   }
 }
+
+module.exports = build

programming_language: JavaScript
filename: version.default-versioning.test.js
change_type: ModificationType.MODIFY
diff: @@ -240,3 +240,28 @@ test('It should throw if you declare multiple times the same route', t => {
     t.is(err.message, 'Method \'GET\' already declared for route \'/\' version \'1.2.3\'')
   }
 })
+
+test('Versioning won\'t work if there are no versioned routes', t => {
+  t.plan(2)
+
+  const findMyWay = FindMyWay({
+    defaultRoute: (req, res) => {
+      t.fail('We should not be here')
+    }
+  })
+
+  findMyWay.on('GET', '/', (req, res) => {
+    t.pass('Yeah!')
+  })
+
+  findMyWay.lookup({
+    method: 'GET',
+    url: '/',
+    headers: { 'accept-version': '2.x' }
+  }, null)
+
+  findMyWay.lookup({
+    method: 'GET',
+    url: '/'
+  }, null)
+})

programming_language: Ruby