Description
Node.js中存在一个HTTP请求走私漏洞。该漏洞是由于对Transfer-Encoding的输入验证不当导致的。
Node.js llhttp 模块多个 Transfer-Encoding 字段请求走私漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases
https://github.com/advisories/GHSA-5689-v88g-g6rv
https://hackerone.com/reports/1524555
https://zeropath.com/blog/cve-2022-35256-nodejs-http-request-smuggling
https://www.tenablecloud.cn/plugins/nessus/165633
https://www.sentinelone.com/vulnerability-database/cve-2022-32213/
https://research.jfrog.com/vulnerabilities/nodejs-http-smuggling-xray-231662/
https://app.opencve.io/cve/?vendor=llhttp
https://niubl.github.io/2021/05/02/http-request-smuggling-in-nodejs/