CVE-2018-7160

Description

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.

How to fix CVE-2018-7160

To remediate CVE-2018-7160, upgrade the affected package to a fixed version below.

• —upgrade to 8.11.0-r0 or later
• —upgrade to 8.11.1~dfsg-2 or later

Is CVE-2018-7160 being exploited?

Low — EPSS is 1.5%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 8.11.0-r0
• from 0, < 8.11.1~dfsg-2

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2018-7160
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2018-7160