Is CVE-2022-21667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-21667 being exploited in the wild.

How severe is CVE-2022-21667?

Low severity, with a CVSS score of 3.1, published 8 January 2022.

Which products and versions are affected?

@soketi/soketi (npm) SEMVER:introduced=0,fixed=0.24.1; Soketi <0.24.1.

Is there a fix for CVE-2022-21667?

Yes. @soketi/soketi (npm): upgrade to 0.24.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-21667 attacked?

It is attacked over the network.

Am I affected by CVE-2022-21667?

Check whether you run @soketi/soketi (npm) or Soketi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-21667: soketi denial of service via empty POST request

Q: Is there a fix for CVE-2022-21667?

Yes. @soketi/soketi (npm): upgrade to 0.24.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2022-21667 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2022-21667?

Check whether you run @soketi/soketi (npm) or Soketi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-21667 · Severity: low · CVSS 3.1 · Published 2022-01-08

soketi is an open-source WebSocket server commonly used for real-time messaging in web applications. An attacker can crash the server by sending an empty POST request to any endpoint, even without authentication. This causes service unavailability and disrupts all connected users' real-time communications.

Technologies: @soketi/soketi (npm), Soketi. Vendors: npm, Soketi.

Quick answers

Is CVE-2022-21667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-21667 being exploited in the wild.
How severe is CVE-2022-21667?: Low severity, with a CVSS score of 3.1, published 8 January 2022.
Which products and versions are affected?: @soketi/soketi (npm) SEMVER:introduced=0,fixed=0.24.1; Soketi <0.24.1.
Is there a fix for CVE-2022-21667?: Yes. @soketi/soketi (npm): upgrade to 0.24.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-21667 attacked?: It is attacked over the network.
Am I affected by CVE-2022-21667?: Check whether you run @soketi/soketi (npm) or Soketi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@soketi/soketi (npm): upgrade to 0.24.1 or later
```
npm install @soketi/soketi@0.24.1
```

Technical details

This is an improper error handling vulnerability (CWE-755) in soketi's POST request handling logic. When a POST request with an empty body is sent to any server endpoint, the application attempts to send a response after the request connection has already closed, causing an unhandled exception that crashes the entire server process. No authentication is required—an unauthenticated attacker on the network can trigger the crash. The vulnerability affects all versions prior to 0.24.1 and has been patched in that release.

Affected products

soketi soketi <0.24.1

Identifiers

CVE-2022-21667
GHSA-86ch-6w7v-v6xf

Timeline

2022-01-07: disclosed: GitHub advisory published
2022-01-07: patched: Version 0.24.1 released with fix
2022-01-08: advisory

References

https://github.com/soketi/soketi/security/advisories/GHSA-86ch-6w7v-v6xf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.