Executive brief
superagent is a popular HTTP request library used by JavaScript/Node.js applications. The library fails to validate the size of ZIP-compressed HTTP responses before decompressing them, allowing attackers to send specially crafted "zip bomb" files that expand to enormous sizes. This causes unchecked consumption of CPU, memory, and disk resources, potentially making applications unavailable or crashing the server.
Technical details
The vulnerability is a resource exhaustion/denial of service flaw in the HTTP response handling code. superagent does not check post-decompression size limits (CWE-400, CWE-409) before inflating ZIP-compressed payloads. An attacker can craft a small ZIP file that decompresses to many gigabytes, causing uncontrolled resource consumption. The attack requires only network access to the application and no authentication; a malicious or compromised HTTP endpoint is sufficient. An exploit can trigger out-of-memory errors, exhaust disk space, or hang the application. The vulnerability was fixed in version 3.7.0 and later.
Affected products
- superagent superagent <3.7.0
Timeline
- 2018-08-09: disclosed
- 2017: patched: Fixed in version 3.7.0