Junglewise Threat Intelligence

CVE-2022-21676: Socket.io engine.io denial of service via uncaught exception

CVE-2022-21676 · Severity: low · CVSS 3.1 · Published 2022-01-13

Executive brief

Engine.IO is a core component used by Socket.IO to manage real-time communication between web browsers and servers. A vulnerability in this component allows an attacker to crash the server by sending a specifically crafted request. This results in a denial-of-service, potentially disrupting real-time features like chat, notifications, or live updates for all users.

Technical details

A vulnerability exists in Engine.IO versions 4.0.0 and later where improper handling of exceptional conditions during WebSocket frame processing can lead to an uncaught exception. Specifically, a malicious client can send a crafted HTTP request that triggers a 'RangeError: Invalid WebSocket frame' within the underlying 'ws' library's receiver. Because this exception is not caught by the Engine.IO server, it causes the entire Node.js process to terminate. The issue is reachable over the network without authentication. Fixes are available in versions 4.1.2, 5.2.1, and 6.1.1.

Affected products

  • Socket.io engine.io >= 4.0.0, < 4.1.2
  • Socket.io engine.io >= 5.0.0, < 5.2.1
  • Socket.io engine.io >= 6.0.0, < 6.1.1

Timeline

  • 2022-01-12: advisory: Original GitHub Security Advisory published
  • 2022-01-12: patched: Fixes released in versions 4.1.2, 5.2.1, and 6.1.1
  • 2022-01-13: disclosed: Public disclosure of CVE-2022-21676

References