N/A

Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.

N/A

输入验证不恰当

Http-signature 安全漏洞

Http-signature是一个包括了具有Joyent HTTP签名方案的客户端和服务器组件的库。 Http-signature 0.9.11及之前版本中存在安全漏洞。攻击者可通过拦截请求利用该漏洞在不更改签名的情况下替换包头名并更改请求。

N/A

N/A