CVE-2021-23490
📋 TL;DR
This vulnerability in parse-link-header package allows attackers to cause Denial of Service (DoS) through specially crafted link headers that trigger inefficient regular expression processing. It affects applications using parse-link-header versions before 2.0.0 to parse HTTP Link headers.
💻 Affected Systems
- parse-link-header
📦 What is this software?
Parse Link Header by Parse Link Header Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion from ReDoS attack, potentially affecting all users of the vulnerable application.
Likely Case
Degraded performance or temporary service disruption when malicious link headers are processed.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending malicious HTTP Link headers to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.0
Vendor Advisory: https://github.com/thlorenz/parse-link-header/commit/72f05c717b3f129c5331a07bf300ed8886eb8ae1
Restart Required: Yes
Instructions:
1. Update parse-link-header dependency to version 2.0.0 or later. 2. Update package.json to specify 'parse-link-header': '^2.0.0'. 3. Run npm update parse-link-header. 4. Restart the application.
🔧 Temporary Workarounds
Input Validation
allImplement input validation to reject or sanitize link headers before passing to parse-link-header.
Rate Limiting
allImplement rate limiting on endpoints that process link headers to mitigate DoS impact.
🧯 If You Can't Patch
- Implement WAF rules to block malicious link header patterns
- Deploy reverse proxy with request filtering for link headers
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/parse-link-header/package.json for version number below 2.0.0.Check Version:
npm list parse-link-headerVerify Fix Applied:
Confirm parse-link-header version is 2.0.0 or higher in package.json and verify application functions correctly with link headers.📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- Increased request processing times
- Application crashes when processing specific requests
Network Indicators:
- Unusually large or complex Link headers in HTTP requests
- Repeated requests with similar link headers
SIEM Query:
source="application_logs" AND ("high cpu" OR "slow response") AND "link-header"🔗 References
- https://github.com/thlorenz/parse-link-header/commit/72f05c717b3f129c5331a07bf300ed8886eb8ae1
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2321973
- https://snyk.io/vuln/SNYK-JS-PARSELINKHEADER-1582783
- https://github.com/thlorenz/parse-link-header/commit/72f05c717b3f129c5331a07bf300ed8886eb8ae1
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2321973
- https://snyk.io/vuln/SNYK-JS-PARSELINKHEADER-1582783
