New Node2Shell RCE vulnerability could hit servers, home appliances, and more

The bug is an Out-of-Bounds Write in the Google Brotli Decoder and has a CVSS score of 9.2.

“A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream,” its description said.

“Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.”

The vulnerability could impact several coding ecosystems, including, but not limited to, Python, Go, and .NET. Similarly, both Chrome and Firefox, as well as platforms such as Discord and Slack, could all be impacted.

WatchTowr’s principal threat intelligence specialist, Yordan Ganchev, once again outlines the implications of this new threat – and he is sounding tired.

“At this point, I think we can all agree that this year’s Cyber Security Awareness Month has achieved its goal in just one week,” Yanchev told Cyber Daily.

VIEW ALL

“The beatings have continued, and the contributors have been plentiful. The PHP2Shell apocalypse apparently wasn’t enough for us, and Node.js came in swinging with Node2Shell as well.

“Although the anxiety-provoking ‘product2Shell’ moniker has remained fashionable this week, the bug is implementation-specific and does not affect every server running Node.js out of the box.”

Despite that limited scope, Yanchev said, the implications could go far beyond code.

“Because Node.js runs almost everywhere nowadays, including in your fridge and coffee machine, some systems will be affected,” he said.

“Even if you don’t natively handle compression, something in your third-, fourth-, or fifth-party dependency tree likely does. Applications that process user-supplied input via Express and body-parser libraries, in particular, have been shown to be vulnerable.”

According to Yanchev, Node2Shell could easily affect externally hosted applications, in addition to “systems that unsuspecting victims may not be aware of”.

“Users running public-facing Node.js applications should patch their systems as soon as possible and monitor vendor advisories for updates related to Node2Shell. Where patching is not immediately possible, they should block incoming requests at the perimeter that include a Content-Encoding HTTP header with a value of ‘br’,” he said.

“Any process crashes or application logs that reference Decompression failed’ should be investigated immediately.”