CVE-2022-29167
📋 TL;DR
CVE-2022-29167 is a regular expression denial-of-service (ReDoS) vulnerability in the Hawk HTTP authentication library. Attackers can craft malicious Host headers to cause exponential computation time increases, potentially crashing or severely degrading server performance. This affects any application using vulnerable versions of the Hawk library for HTTP authentication.
💻 Affected Systems
- Hawk HTTP authentication library
📦 What is this software?
Hawk by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to server resource exhaustion, potentially affecting multiple services on the same host.
Likely Case
Degraded server performance and increased response times, potentially leading to partial service disruption.
If Mitigated
Minimal impact with proper rate limiting, input validation, and updated library versions.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests with malicious Host headers to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.1
Vendor Advisory: https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
Restart Required: Yes
Instructions:
1. Update Hawk dependency to version 9.0.1 or later. 2. Update package.json to specify 'hawk': '>=9.0.1'. 3. Run npm update hawk or yarn upgrade hawk. 4. Restart affected Node.js applications.
🔧 Temporary Workarounds
Input validation middleware
allAdd middleware to validate and sanitize Host headers before they reach Hawk authentication.
// Example Express middleware:
app.use((req, res, next) => {
const host = req.headers.host;
if (!host || host.length > 255 || !/^[a-zA-Z0-9.-]+(:[0-9]+)?$/.test(host)) {
return res.status(400).send('Invalid Host header');
}
next();
});
Rate limiting
allImplement rate limiting to prevent repeated malicious requests from overwhelming the server.
// Using express-rate-limit:
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
windowMs: 15 * 60 * 1000,
max: 100
});
app.use(limiter);
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block requests with suspicious Host headers
- Use reverse proxy with request filtering to sanitize Host headers before reaching vulnerable applications
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/hawk/package.json for version number below 9.0.1Check Version:
npm list hawk | grep hawk OR cat node_modules/hawk/package.json | grep versionVerify Fix Applied:
Confirm Hawk version is 9.0.1 or higher and test authentication with various Host headers📡 Detection & Monitoring
Log Indicators:
- Unusually long request processing times
- Multiple failed authentication attempts with varying Host headers
- High CPU usage spikes coinciding with authentication requests
Network Indicators:
- HTTP requests with unusually long or malformed Host headers
- Rapid sequential requests to authentication endpoints
SIEM Query:
source="web_server" (host_header_length>255 OR host_header contains ".." OR host_header matches "[^a-zA-Z0-9.-:]+")