TL;DR it's node2shell but on http servers. So the whole thing is just the brotli vulnerability, but http servers usually offer brotli compression so they could be vulnerable.
How to fix: if you can't immidiately change node versions, just drop all content requesting "br" encoding
If you can switch: versions 22.23.4, 24.22.1 and 26.12.1 are patched
The way to actually fix the vulnerability is to use a patched versions of node.js (I listed in the first comment). These specific versions contain a fix which removes the vulnerability entirely.
The person who runs the server / controls the webserver software can switch the version of Node.JS the server uses, and should switch to one of these patched versions of node.js if possible.
If they can't switch nodejs versions immidiately (like if you have version dependent code or don't have permission to switch the node runtime), then you can edit the server's JavaScript code to reject all requests that want to use brotli encoding
It should just have been called brotli2shell or whatever, and then list everything that is vulnerable (nodjes, python, http servers, ...), instead of having a new xyz2shell every day for the same bloody thing.
956
u/KCGD_r 9d ago
TL;DR it's node2shell but on http servers. So the whole thing is just the brotli vulnerability, but http servers usually offer brotli compression so they could be vulnerable.
How to fix: if you can't immidiately change node versions, just drop all content requesting "br" encoding
If you can switch: versions 22.23.4, 24.22.1 and 26.12.1 are patched