Junglewise Threat Intelligence

CVE-2022-21208: node-opcua denial of service via message chunks

CVE-2022-21208 · Severity: low · CVSS 3.1 · Published 2022-08-24

Executive brief

node-opcua is a JavaScript implementation of the OPC UA industrial automation protocol stack. A flaw in how the library assembles incoming message chunks allows an attacker to send unlimited large chunks (e.g., 2GB each) without completing the transmission, causing the server to exhaust memory and crash. This can render OPC UA-dependent industrial systems and SCADA applications unavailable.

Technical details

The vulnerability is a resource exhaustion flaw (CWE-400) in the packet assembler component of node-opcua. The vulnerability stems from missing validation and limits on the number of received message chunks, both per-session and globally across concurrent sessions. An attacker can exploit this by sending a stream of large incomplete OPC UA message chunks to a vulnerable server without ever sending the required "final" chunk marker. This causes the server to accumulate unbounded amounts of memory as it buffers these chunks, leading to memory exhaustion and denial of service. The attack is network-based and requires no authentication or user interaction. The fix, introduced in version 2.74.0, adds chunk size verification and enforces limits on accumulated chunk data.

Affected products

  • node-opcua node-opcua < 2.74.0

Timeline

  • 2022-08-23: disclosed: CVE-2022-21208 disclosed
  • 2022-08-24: advisory: GHSA-4hr4-pjjh-2q2w published
  • 2022-06-02: patched: Patches merged in PR #1149 and commits addressing message chunk overflow detection

References

Related threats