CVE-2017-16129 superagent vulnerable to zip bomb attacks
MediumCVSS 5.9
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm superagent(npm) | < 3.7.0 | 3.7.0 |
| debian/node-superagent(Debian:12) | < 0.20.0+dfsg-2 | 0.20.0+dfsg-2 |
| debian/node-superagent(Debian:13) | < 0.20.0+dfsg-2 | 0.20.0+dfsg-2 |
| debian/node-superagent(Debian:14) | < 0.20.0+dfsg-2 | 0.20.0+dfsg-2 |
| superagent project superagent | < 3.7.0 | 3.7.0 |
| HackerOne superagent node module | = <3.7.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com issue-tracking patch third-party-advisory
- en.wikipedia.org
- github.com
- www.npmjs.com
- Debian Security Tracker CVE-2017-16129 vendor-advisory
- nodesecurity.io third-party-advisory