CVE-2021-22883
📋 TL;DR
Node.js servers are vulnerable to denial of service attacks when attackers establish numerous connections with unknown protocols, causing file descriptor leaks. This can exhaust system resources, preventing new connections and potentially crashing the server. Affected are Node.js servers running vulnerable versions before patches were released.
💻 Affected Systems
- Node.js
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Graalvm by Oracle
Graalvm by Oracle
Graalvm by Oracle
Node.js by Nodejs
Node.js by Nodejs
Node.js by Nodejs
Node.js by Nodejs
Peoplesoft Enterprise Peopletools by Oracle
Peoplesoft Enterprise Peopletools by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to file descriptor exhaustion or memory depletion, rendering the server unable to accept new connections or perform basic operations.
Likely Case
Degraded performance and intermittent service disruptions as file descriptors are consumed, potentially leading to partial outages.
If Mitigated
Minimal impact with proper resource limits and monitoring in place, though some performance degradation may occur during attack attempts.
🎯 Exploit Status
Exploitation requires only network access to send malformed connection attempts; tools for DoS attacks could easily incorporate this.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Node.js 10.24.0, 12.21.0, 14.16.0, 15.10.0 or later
Vendor Advisory: https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/
Restart Required: Yes
Instructions:
1. Identify current Node.js version using 'node -v'. 2. Upgrade to a patched version using your package manager (e.g., 'npm install -g n' and 'n stable' or 'n lts'). 3. Restart all Node.js applications and services.
🔧 Temporary Workarounds
Set file descriptor limits
linuxConfigure system-wide or per-process file descriptor limits to prevent exhaustion.
ulimit -n 4096
Edit /etc/security/limits.conf to set 'nofile' limits
Implement rate limiting
allUse network firewalls or load balancers to limit connection attempts from single sources.
🧯 If You Can't Patch
- Deploy network-level protections like WAFs or firewalls to block excessive connection attempts.
- Monitor file descriptor usage and restart services if thresholds are exceeded.
🔍 How to Verify
Check if Vulnerable:
Run 'node -v' and compare to affected versions; if below 10.24.0, 12.21.0, 14.16.0, or 15.10.0, it's vulnerable.Check Version:
node -vVerify Fix Applied:
After patching, confirm version is at or above the patched versions and test with simulated connection attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual spikes in 'unknownProtocol' errors or connection failures in Node.js logs.
Network Indicators:
- High volume of failed connection attempts from single IPs or unusual protocols.
SIEM Query:
source="nodejs.log" AND ("unknownProtocol" OR "ECONNRESET") | stats count by src_ip🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1043360
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/
- https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/
- https://security.netapp.com/advisory/ntap-20210416-0001/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1043360
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/
- https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/
- https://security.netapp.com/advisory/ntap-20210416-0001/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
