Executive brief
ecstatic is a Node.js library that serves static files over HTTP. A vulnerability in HTTP header parsing causes the server to crash when certain malformed date strings are sent in the Last-Modified or If-Modified-Since headers, resulting in service unavailability. An attacker can exploit this with a single HTTP request, causing the application to become unresponsive.
Technical details
The vulnerability is a denial of service triggered by improper handling of date parsing. The vulnerable code passes the Last-Modified or If-Modified-Since HTTP header values directly to JavaScript's Date.parse() and Date constructor without validation. Certain edge-case date strings (e.g., '275760-09-24') trigger a V8 bug that raises an uncaught "illegal access" exception rather than returning an Invalid Date object, crashing the process. The attack requires only network access and no authentication; an attacker sends a crafted HTTP header to any ecstatic instance. The fix, released in version 1.4.0, wraps the date parsing in a try-catch block to handle these exceptions gracefully.
Affected products
- npm ecstatic before 1.4.0
Timeline
- 2018-06-07: disclosed
- 2015-12-22: patched: Fix merged in PR #179