Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
CVE-2022-29167 - High Severity Vulnerability
Vulnerable Libraries - hawk-3.1.3.tgz, hawk-6.0.2.tgz
hawk-3.1.3.tgz
HTTP Hawk Authentication Scheme
Library home page: https://registry.npmjs.org/hawk/-/hawk-3.1.3.tgz
Path to dependency file: /PrestaShop/tests/E2E/package.json
Path to vulnerable library: /tests/E2E/package.json
Dependency Hierarchy: - selenium-standalone-6.14.0.tgz (Root Library) - request-2.79.0.tgz - :x: **hawk-3.1.3.tgz** (Vulnerable Library)
hawk-6.0.2.tgz
HTTP Hawk Authentication Scheme
Library home page: https://registry.npmjs.org/hawk/-/hawk-6.0.2.tgz
Path to dependency file: /PrestaShop/tests/Selenium/package.json
Path to vulnerable library: /tests/Selenium/package.json
Dependency Hierarchy: - request-2.83.0.tgz (Root Library) - :x: **hawk-6.0.2.tgz** (Vulnerable Library)
Found in HEAD commit: bb7465065dfeed9f49bb99b6901ab933563af739
Found in base branch: develop
Vulnerability Details
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
Publish Date: 2022-05-05
URL: CVE-2022-29167
CVSS 3 Score Details (7.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
Release Date: 2022-05-05
Fix Resolution (hawk): 9.0.1
Direct dependency fix Resolution (selenium-standalone): 6.15.0
Fix Resolution (hawk): 9.0.1
Direct dependency fix Resolution (request): 2.87.0
Step up your Open Source Security Game with Mend here