Quick answers
- Is CVE-2016-10703 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-10703 being exploited in the wild.
- How severe is CVE-2016-10703?
- Low severity, with a CVSS score of 3.1, published 28 December 2017.
- Which products and versions are affected?
- ecstatic (npm) <2.0.0.
- Is there a fix for CVE-2016-10703?
- A patch was published on 2.0.0: Fixed by restoring null-byte filtering Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-10703 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2016-10703?
- Check whether you run ecstatic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a denial of service caused by improper handling of null bytes in URL paths. ecstatic previously stripped null bytes from URLs as a workaround for an old Node.js url.parse bug, but removal of this filtering exposed a regex-based denial-of-service attack vector. An unauthenticated network attacker can send crafted HTTP requests with null-byte-laden payloads to trigger excessive memory allocation and crash the server. A 86 kB payload was observed to cause immediate crash. The vulnerability affects all versions prior to 2.0.0, which restored null-byte filtering to mitigate the issue.
Affected products
- npm ecstatic <2.0.0
Identifiers
- CVE-2016-10703
- GHSA-pm9p-9926-w68m
Timeline
- 2017-12-14: disclosed
- 2.0.0: patched: Fixed by restoring null-byte filtering
- 2017-12-28: advisory