Evolving Threat: http2shell is an RCE in node, Python, and more
A new Remote Code Execution (RCE) vulnerability, dubbed 'http2shell', has surfaced, threatening Node.js, Python, and other environments through the widely used Brotli compression library. This story is popular on HN because it highlights a critical supply chain security flaw, forcing developers to scramble for immediate patches and reconsider fundamental HTTP/2 and compression practices. The discussion quickly pivots to dissecting the technical specifics of the vulnerability and the urgency of mitigation strategies across various language ecosystems.
The Lowdown
A recently identified severe security vulnerability, 'http2shell', poses an Remote Code Execution (RCE) risk to applications built with popular technologies like Node.js and Python. The root cause appears to lie within the Brotli compression library, a common component for optimizing web traffic.
- The vulnerability is tied to the Brotli library, specifically versions up to and including 1.2.0.
- It has been observed to affect multiple programming environments, including Node.js and Python.
- Initial mitigation strategies suggest disabling Brotli (
br) content-encoding on both client and server sides. - A fix for the underlying Brotli issue was committed in February, indicating the vulnerability might have been present for some time before public disclosure.
- The Python
brotlipackage has already been updated to version 1.2.1, which presumably contains the fix.
This RCE threat underscores the critical importance of keeping dependencies updated and being vigilant about compression library usage, as such components often operate at a low level, making their exploits particularly dangerous.
The Gossip
Brotli's Bugbear: Dissecting the Vulnerability and Fixes
Commenters quickly dove into the technical details of the 'http2shell' vulnerability, confirming its tie to the `brotli` compression library, specifically versions `1.2.0` and earlier. The discussion highlighted that a fix was already committed to the official Brotli repository back in February, leading to swift updates in downstream packages like Python's `brotli` (now at `1.2.1`). Users debated the impact on different language ecosystems, with some noting that Rust implementations might be unaffected if they don't bind to the vulnerable C library. The immediate mitigation suggested was to disable Brotli content-encoding entirely.
Source Seeking & Sharing
In an effort to provide direct access to the original source and bypass the Nitter proxy, a helpful commenter provided the direct X.com link to the Aikido Security tweet disclosing the vulnerability. This ensured that those interested could view the information without relying on the intermediate service.