Is CVE-2017-16031 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-16031 being exploited in the wild.

How severe is CVE-2017-16031?

Low severity, with a CVSS score of 3, published 7 November 2018.

Which products and versions are affected?

socket.io (npm) SEMVER:introduced=0,fixed=0.9.7.

Is there a fix for CVE-2017-16031?

Yes. socket.io (npm): upgrade to 0.9.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-16031 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-16031?

Check whether you run socket.io (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-16031: socket.io insecure randomness in socket ID generation

CVE-2017-16031 · Severity: low · CVSS 3 · Published 2018-11-07

socket.io is a popular JavaScript library used to enable real-time, bidirectional communication between web clients and servers. The library used predictable random number generation to create socket IDs, allowing attackers to guess valid session identifiers and gain unauthorized access to other users' socket connections without credentials. This could lead to eavesdropping on private communications or hijacking sessions.

Technologies: socket.io (npm). Vendors: npm.

Quick answers

Is CVE-2017-16031 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-16031 being exploited in the wild.
How severe is CVE-2017-16031?: Low severity, with a CVSS score of 3, published 7 November 2018.
Which products and versions are affected?: socket.io (npm) SEMVER:introduced=0,fixed=0.9.7.
Is there a fix for CVE-2017-16031?: Yes. socket.io (npm): upgrade to 0.9.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-16031 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-16031?: Check whether you run socket.io (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

socket.io (npm): upgrade to 0.9.7 or later
```
npm install socket.io@0.9.7
```

Technical details

The vulnerability stems from socket.io's use of Math.random() in the Manager.generateId() method to create socket identifiers. Math.random() is a cryptographically weak pseudorandom number generator, producing predictable output that an attacker can forecast with sufficient knowledge of prior IDs. An attacker on the network can observe previous socket IDs and predict subsequent identifiers, then connect to the server with a guessed ID to impersonate another client without authentication. The fix involves replacing Math.random() with cryptographically secure random generation (e.g., crypto.randomBytes()) as described in RFC 4086. The vulnerability was patched in version 0.9.7 and later.

Affected products

socket.io socket.io 0.9.6 and earlier

Identifiers

CVE-2017-16031
GHSA-qv2v-m59f-v5fw

Timeline

2012-04-26: disclosed: Issue #856 opened on GitHub
2017: patched: Fixed in version 0.9.7
2018-11-07: advisory: GHSA-qv2v-m59f-v5fw published

References

https://github.com/socketio/socket.io/issues/856

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.