Executive brief
ecstatic is a lightweight static file server middleware used to serve files in Node.js applications. A denial of service vulnerability in its URL parameter parsing could allow an attacker to crash applications using this library by sending a specially crafted request with invalid header characters, causing the server to become unavailable.
Technical details
The vulnerability exists in ecstatic's URL parameter parsing during redirect handling. When processing requests with certain URL parameters (specifically containing invalid characters like \x0c), the library attempts to redirect the URL but fails to properly sanitize the input, resulting in a TypeError when invalid header characters are included in the response. The vulnerability is triggered via a network request and requires no authentication. An attacker can exploit this by sending a crafted URL (e.g., with a form-feed character in the query string) to crash the application. The issue is tracked as CWE-400 (uncontrolled resource consumption). Patched versions 4.1.3 and later address this vulnerability.
Affected products
- ecstatic ecstatic <4.1.3
Timeline
- 2019-12-31: disclosed
- 2020-12-15: advisory: GHSA advisory published