CVE-2020-27543: 
JavaScript vulnerability analysis and mitigation

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception. The vulnerability was discovered in November 2020 and affects version 0.0.5 of the package which had approximately 2,183 weekly downloads and at least 150,000 total downloads since release (GITHUB_SECOATS).

The vulnerability occurs when the package is used as middleware and gets executed on every HTTP request to an endpoint. Any HTTP request without the HTTP Host-header sent to any existing API endpoint will cause the server to crash due to an uncaught exception in the middleware. The issue affects all endpoints regardless of whether the pagination feature is actually used. The exception is not caught by the standard restify error handler 'restify-errors'. The vulnerability has a CVSS v3.1 base score of 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (NVD, NETAPP_ADVISORY).

Successful exploitation of this vulnerability could lead to Denial of Service (DoS) by causing the Node.js server instance to crash. The vulnerability affects any endpoint on the server where the middleware is implemented, making it a significant availability risk (NETAPP_ADVISORY).

The vulnerability is easily exploitable by sending a valid HTTP/1.0 request without a Host header to any existing API endpoint. While the Host header is technically required for HTTP/1.1, neither Node.js nor Restify reject requests missing this header. A proof of concept exploit has been published demonstrating the vulnerability (GITHUB_SECOATS).

A quick fix for users of restify-paginate is setting hostname: false in the paginate() options. This hostname option is set to true by default. Disabling that option appears to skip over the affected code segment (GITHUB_SECOATS).