Is CVE-2015-9242 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-9242 being exploited in the wild.

How severe is CVE-2015-9242?

Informational severity, published 7 June 2018.

Is there a fix for CVE-2015-9242?

A patch was published on 2015-12-22: Fix merged in PR #179 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-9242 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2015-9242?

Check whether you run ecstatic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-9242: ecstatic denial of service via HTTP headers

CVE-2015-9242 · Severity: info · Published 2018-06-07

ecstatic is a Node.js library that serves static files over HTTP. A vulnerability in HTTP header parsing causes the server to crash when certain malformed date strings are sent in the Last-Modified or If-Modified-Since headers, resulting in service unavailability. An attacker can exploit this with a single HTTP request, causing the application to become unresponsive.

Technologies: ecstatic (npm). Vendors: npm.

Quick answers

Is CVE-2015-9242 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-9242 being exploited in the wild.
How severe is CVE-2015-9242?: Informational severity, published 7 June 2018.
Which products and versions are affected?: ecstatic (npm) before 1.4.0.
Is there a fix for CVE-2015-9242?: A patch was published on 2015-12-22: Fix merged in PR #179 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-9242 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2015-9242?: Check whether you run ecstatic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial of service triggered by improper handling of date parsing. The vulnerable code passes the Last-Modified or If-Modified-Since HTTP header values directly to JavaScript's Date.parse() and Date constructor without validation. Certain edge-case date strings (e.g., '275760-09-24') trigger a V8 bug that raises an uncaught "illegal access" exception rather than returning an Invalid Date object, crashing the process. The attack requires only network access and no authentication; an attacker sends a crafted HTTP header to any ecstatic instance. The fix, released in version 1.4.0, wraps the date parsing in a try-catch block to handle these exceptions gracefully.

Affected products

npm ecstatic before 1.4.0

Identifiers

CVE-2015-9242
GHSA-vwjc-q9px-r9vq

Timeline

2018-06-07: disclosed
2015-12-22: patched: Fix merged in PR #179

References

https://github.com/jfhbrook/node-ecstatic/pull/179

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.