Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue — Node.js problem may also affect millions of sites
- A critical Brotli compression flaw, dubbed HTTP2Shell, could enable memory corruption and remote code execution
- The vulnerability affects widely used software including Node.js, Python packages, and .NET applications
- Vendors released patches, and administrators are urged to update immediately despite no confirmed in-the-wild exploitation
Multiple tech companies and projects have recently pushed patches for a vulnerability called “HTTP2Shell” which could enable remote code execution (RCE) attacks, similar to the recent “PHP2Shell” vulnerabilities.
HTTP2Shell was found in Brotli, a Google-built open source data compression algorithm that reduces file sizes without losing information, thus achieving faster transmission times while using less bandwidth.
It is a popular algorithm used on the web to compress HTTP responses such as HTML, CSS, and JavaScript, and is supported by most web browsers, servers, and software libraries.
Fixes and patches
The bug itself is described as an out-of-bounds write flaw, and is also dubbed Node2Shell, and Broccoli2Shell....
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
