CVE-2024-21536
📋 TL;DR
A Denial of Service vulnerability in http-proxy-middleware allows attackers to crash Node.js servers by sending requests to specific paths. This affects all applications using vulnerable versions of the middleware package. The vulnerability stems from an unhandled promise rejection in the micromatch dependency.
💻 Affected Systems
- http-proxy-middleware
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server crash leading to service unavailability for all users until manual restart.
Likely Case
Targeted DoS attacks causing intermittent service disruptions and increased operational overhead.
If Mitigated
Minimal impact with proper monitoring and automatic restart mechanisms in place.
🎯 Exploit Status
Exploitation requires sending HTTP requests to specific paths that trigger the micromatch error.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.7 or 3.0.3
Vendor Advisory: https://github.com/chimurai/http-proxy-middleware/security/advisories
Restart Required: Yes
Instructions:
1. Update package.json to use http-proxy-middleware version 2.0.7 or 3.0.3. 2. Run 'npm update http-proxy-middleware' or 'yarn upgrade http-proxy-middleware'. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Implement global unhandled promise rejection handler
allAdd process-level error handling to prevent Node.js process crashes
process.on('unhandledRejection', (reason, promise) => { console.error('Unhandled Rejection at:', promise, 'reason:', reason); });
🧯 If You Can't Patch
- Implement rate limiting to restrict request frequency to vulnerable endpoints
- Deploy reverse proxy with request filtering to block malicious path patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for http-proxy-middleware version. Vulnerable if version <2.0.7 or between 3.0.0-3.0.2.Check Version:
npm list http-proxy-middlewareVerify Fix Applied:
Verify installed version is 2.0.7 or 3.0.3+ and test with known exploit paths.📡 Detection & Monitoring
Log Indicators:
- Unhandled promise rejection errors
- Node.js process crashes
- Increased error rates in application logs
Network Indicators:
- Repeated requests to unusual paths
- Spike in 500 errors from proxy endpoints
SIEM Query:
source="application.logs" AND ("unhandledRejection" OR "micromatch" OR "http-proxy-middleware crash")🔗 References
- https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a
- https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5
- https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22
- https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906
