Executive brief
soketi is an open-source WebSocket server commonly used for real-time messaging in web applications. An attacker can crash the server by sending an empty POST request to any endpoint, even without authentication. This causes service unavailability and disrupts all connected users' real-time communications.
Technical details
This is an improper error handling vulnerability (CWE-755) in soketi's POST request handling logic. When a POST request with an empty body is sent to any server endpoint, the application attempts to send a response after the request connection has already closed, causing an unhandled exception that crashes the entire server process. No authentication is required—an unauthenticated attacker on the network can trigger the crash. The vulnerability affects all versions prior to 0.24.1 and has been patched in that release.
Affected products
- soketi soketi <0.24.1
Timeline
- 2022-01-07: disclosed: GitHub advisory published
- 2022-01-07: patched: Version 0.24.1 released with fix
- 2022-01-08: advisory