High, CVSS 7.5npmAmendedPublished
Header Forgery in http-signature
CVE-2017-16005 · GHSA-q257-vv4p-fg92
- Affected
- npm http-signature < 0.10.0
- Fixed in
- 0.10.0· Vendor fix available
- Issue
- Affected versions of http-signature contain a vulnerability which can allow an attacker in a privileged network position to modify header names and change the meaning of the request, without requiring an updated signature. This problem occurs because vulnerable versions of http-signature sign the contents of headers, but not the header names. Proof of Concept Consider this to be the initial, untampered request: And the request is intercepted and tampered as follows: In the resulting responses, both requests would pass signature verification without issue. Recommendation Update to version 0.10.0 or higher.
Recommended action: Upgrade to 0.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.