CVE-2022-21676: Socket.io engine.io denial of service via uncaught exception

CVE-2022-21676 · Severity: low · CVSS 3.1 · Published 2022-01-13

Engine.IO is a core component used by Socket.IO to manage real-time communication between web browsers and servers. A vulnerability in this component allows an attacker to crash the server by sending a specifically crafted request. This results in a denial-of-service, potentially disrupting real-time features like chat, notifications, or live updates for all users.

Quick answers

Is CVE-2022-21676 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-21676 being exploited in the wild.
How severe is CVE-2022-21676?
Low severity, with a CVSS score of 3.1, published 13 January 2022.
Which products and versions are affected?
Socket.io engine.io >= 4.0.0, < 4.1.2; Socket.io engine.io >= 5.0.0, < 5.2.1; Socket.io engine.io >= 6.0.0, < 6.1.1.
Is there a fix for CVE-2022-21676?
A patch was published on 2022-01-12: Fixes released in versions 4.1.2, 5.2.1, and 6.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-21676 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-21676?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Engine.IO versions 4.0.0 and later where improper handling of exceptional conditions during WebSocket frame processing can lead to an uncaught exception. Specifically, a malicious client can send a crafted HTTP request that triggers a 'RangeError: Invalid WebSocket frame' within the underlying 'ws' library's receiver. Because this exception is not caught by the Engine.IO server, it causes the entire Node.js process to terminate. The issue is reachable over the network without authentication. Fixes are available in versions 4.1.2, 5.2.1, and 6.1.1.

Affected products

  • Socket.io engine.io >= 4.0.0, < 4.1.2
  • Socket.io engine.io >= 5.0.0, < 5.2.1
  • Socket.io engine.io >= 6.0.0, < 6.1.1

Identifiers

  • CVE-2022-21676
  • GHSA-273r-mgr4-v34f

Timeline

  • 2022-01-12: advisory: Original GitHub Security Advisory published
  • 2022-01-12: patched: Fixes released in versions 4.1.2, 5.2.1, and 6.1.1
  • 2022-01-13: disclosed: Public disclosure of CVE-2022-21676

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.