Executive brief
socket.io is a popular JavaScript library used to enable real-time, bidirectional communication between web clients and servers. The library used predictable random number generation to create socket IDs, allowing attackers to guess valid session identifiers and gain unauthorized access to other users' socket connections without credentials. This could lead to eavesdropping on private communications or hijacking sessions.
Technical details
The vulnerability stems from socket.io's use of Math.random() in the Manager.generateId() method to create socket identifiers. Math.random() is a cryptographically weak pseudorandom number generator, producing predictable output that an attacker can forecast with sufficient knowledge of prior IDs. An attacker on the network can observe previous socket IDs and predict subsequent identifiers, then connect to the server with a guessed ID to impersonate another client without authentication. The fix involves replacing Math.random() with cryptographically secure random generation (e.g., crypto.randomBytes()) as described in RFC 4086. The vulnerability was patched in version 0.9.7 and later.
Affected products
- socket.io socket.io 0.9.6 and earlier
Timeline
- 2012-04-26: disclosed: Issue #856 opened on GitHub
- 2017: patched: Fixed in version 0.9.7
- 2018-11-07: advisory: GHSA-qv2v-m59f-v5fw published