Is CVE-2022-21208 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-21208 being exploited in the wild.

How severe is CVE-2022-21208?

Low severity, with a CVSS score of 3.1, published 24 August 2022.

Which products and versions are affected?

node-opcua (npm) SEMVER:introduced=0,fixed=2.74.0.

Is there a fix for CVE-2022-21208?

Yes. node-opcua (npm): upgrade to 2.74.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-21208 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-21208?

Check whether you run node-opcua (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-21208: node-opcua denial of service via message chunks

CVE-2022-21208 · Severity: low · CVSS 3.1 · Published 2022-08-24

node-opcua is a JavaScript implementation of the OPC UA industrial automation protocol stack. A flaw in how the library assembles incoming message chunks allows an attacker to send unlimited large chunks (e.g., 2GB each) without completing the transmission, causing the server to exhaust memory and crash. This can render OPC UA-dependent industrial systems and SCADA applications unavailable.

Technologies: node-opcua (npm). Vendors: npm.

Quick answers

Is CVE-2022-21208 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-21208 being exploited in the wild.
How severe is CVE-2022-21208?: Low severity, with a CVSS score of 3.1, published 24 August 2022.
Which products and versions are affected?: node-opcua (npm) SEMVER:introduced=0,fixed=2.74.0.
Is there a fix for CVE-2022-21208?: Yes. node-opcua (npm): upgrade to 2.74.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-21208 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-21208?: Check whether you run node-opcua (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-opcua (npm): upgrade to 2.74.0 or later
```
npm install node-opcua@2.74.0
```

Technical details

The vulnerability is a resource exhaustion flaw (CWE-400) in the packet assembler component of node-opcua. The vulnerability stems from missing validation and limits on the number of received message chunks, both per-session and globally across concurrent sessions. An attacker can exploit this by sending a stream of large incomplete OPC UA message chunks to a vulnerable server without ever sending the required "final" chunk marker. This causes the server to accumulate unbounded amounts of memory as it buffers these chunks, leading to memory exhaustion and denial of service. The attack is network-based and requires no authentication or user interaction. The fix, introduced in version 2.74.0, adds chunk size verification and enforces limits on accumulated chunk data.

Affected products

node-opcua node-opcua < 2.74.0

Identifiers

CVE-2022-21208
GHSA-4hr4-pjjh-2q2w

Timeline

2022-08-23: disclosed: CVE-2022-21208 disclosed
2022-08-24: advisory: GHSA-4hr4-pjjh-2q2w published
2022-06-02: patched: Patches merged in PR #1149 and commits addressing message chunk overflow detection

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.