CVE-2024-57177
Published: 10 February 2025
Summary
CVE-2024-57177 is a high-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the host header injection vulnerability in perfood/couch-auth <=0.21.2 by applying patches or upgrading to a fixed version.
Enforces validation of untrusted inputs such as specially crafted host headers in email change confirmation requests to prevent SSTI exploitation.
Restricts host headers to organization-defined valid values, blocking injection payloads that trigger SSTI in the CouchDB auth package.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Host header injection triggers SSTI enabling remote unauthenticated command execution on a public-facing Node.js auth package (T1190); SSTI directly yields limited OS command execution (T1059).
NVD Description
A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run…
more
limited commands or leak server-side information
Deeper analysisAI
CVE-2024-57177 is a host header injection vulnerability in the NPM package perfood/couch-auth versions <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, attackers can trigger a Server-Side Template Injection (SSTI), which can be leveraged to run limited commands or leak server-side information. The vulnerability carries a CVSS score of 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is classified under CWE-1336.
The vulnerability is exploitable remotely over the network by unauthenticated attackers with low attack complexity and no user interaction required. Successful exploitation allows limited command execution or disclosure of server-side information, leading to low impacts on confidentiality, integrity, and availability within the unchanged scope.
Mitigation details, advisories, and patches are available in the referenced GitHub repositories: https://github.com/perfood/couch-auth and https://github.com/waristea/cve-research/tree/main/CVE-2024-57177.
Details
- CWE(s)