Executive brief
nes is a WebSocket extension library for the hapi web server framework. A vulnerability exists where an attacker can crash the entire Node.js server process by sending a specially crafted, invalid cookie during a connection request. This results in a complete service outage, impacting availability for all users.
Technical details
The nes library (<= 6.4.0) fails to properly handle invalid cookie headers when WebSocket authentication is configured to use cookies. Specifically, in the `_authenticate` method within `lib/socket.js`, the code attempts to access properties of a null state object when an invalid cookie is provided. This results in an unhandled 'TypeError: Cannot read property \'nes\' of null', causing the Node.js process to throw an exception and exit. An attacker can trigger this remotely by sending a malformed WebSocket upgrade request. The issue is fixed in version 6.4.1.
Affected products
- hapijs nes <= 6.4.0
Timeline
- 2017-01-27: disclosed: Issue reported on GitHub
- 2017-01-27: patched: Fix committed to repository
- 2018-06-04: advisory: NVD published CVE-2017-16025