CVE-2022-24822 – This vulnerability in Podium's @podium/layout a... (How to Fix)

📋 TL;DR

This vulnerability in Podium's @podium/layout and @podium/proxy modules allows attackers to cause denial of service by sending specially crafted HTTP requests with Trailer headers. All Podium layouts that include podlets with proxy endpoints are affected, potentially taking down the entire server.

💻 Affected Systems

Products:

@podium/layout
@podium/proxy

Versions: @podium/layout < 4.6.110, @podium/proxy < 4.2.74

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: All Podium layouts with podlets using proxy endpoints are vulnerable

📦 What is this software?

Podium Layout by Finn

View all CVEs affecting Podium Layout →

Podium Proxy by Finn

View all CVEs affecting Podium Proxy →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server unavailability leading to service disruption for all users

🟠

Likely Case

Targeted denial of service affecting specific proxy endpoints

🟢

If Mitigated

Minimal impact with proper rate limiting and monitoring

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending HTTP requests with Trailer headers to proxy endpoints

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: @podium/layout 4.6.110+, @podium/proxy 4.2.74+

Vendor Advisory: https://github.com/podium-lib/proxy/security/advisories/GHSA-3hjg-vc7r-rcrw

Restart Required: Yes

Instructions:

1. Update @podium/layout to 4.6.110 or higher
2. Update @podium/proxy to 4.2.74 or higher
3. Restart the application server
4. Verify no breaking changes in release notes

🔧 Temporary Workarounds

No effective workaround

all

The advisory states no easy workaround exists without upgrading

🧯 If You Can't Patch

Implement WAF rules to block or sanitize Trailer headers
Deploy rate limiting on proxy endpoints to reduce attack impact

🔍 How to Verify

Check if Vulnerable:

Check package.json for @podium/layout version < 4.6.110 or @podium/proxy version < 4.2.74

Check Version:

npm list @podium/layout @podium/proxy

Verify Fix Applied:

Confirm package.json shows @podium/layout >= 4.6.110 and @podium/proxy >= 4.2.74

📡 Detection & Monitoring

Log Indicators:

Unusual server crashes or restarts
HTTP requests with Trailer headers to proxy endpoints

Network Indicators:

HTTP requests containing Trailer header to /proxy/ endpoints

SIEM Query:

http.headers contains "Trailer" AND url contains "/proxy/"

📊 Metadata

CVE ID: CVE-2022-24822

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-248

Published: April 6, 2022

Last Updated: November 21, 2024

🔗 References

https://github.com/podium-lib/layout/commit/fe43e655432b0a5f07b6475f67babcc2588fb039 Patch,Third Party Advisory
https://github.com/podium-lib/layout/releases/tag/v4.6.110 Release Notes,Third Party Advisory
https://github.com/podium-lib/proxy/commit/9698a40df081217ce142d4de71f929baaa339cdf Patch,Third Party Advisory
https://github.com/podium-lib/proxy/releases/tag/v4.2.74 Release Notes,Third Party Advisory
https://github.com/podium-lib/proxy/security/advisories/GHSA-3hjg-vc7r-rcrw Third Party Advisory
https://github.com/podium-lib/layout/commit/fe43e655432b0a5f07b6475f67babcc2588fb039 Patch,Third Party Advisory
https://github.com/podium-lib/layout/releases/tag/v4.6.110 Release Notes,Third Party Advisory
https://github.com/podium-lib/proxy/commit/9698a40df081217ce142d4de71f929baaa339cdf Patch,Third Party Advisory
https://github.com/podium-lib/proxy/releases/tag/v4.2.74 Release Notes,Third Party Advisory
https://github.com/podium-lib/proxy/security/advisories/GHSA-3hjg-vc7r-rcrw Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-24822, you might also want to check these: