CVE-2022-2421: Socket.IO Parser improper type validation in packet decoding

CVE-2022-2421 · Severity: low · CVSS 3.1 · Published 2022-10-26

Socket.IO Parser is a library used to encode and decode messages in real-time communication applications. Due to insufficient validation of packet structure, an attacker can inject malicious data that causes application crashes or allows arbitrary function execution on the server, potentially compromising the application's availability and security.

Technologies: socket.io-parser (npm). Vendors: npm.

Quick answers

Is CVE-2022-2421 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-2421 being exploited in the wild.
How severe is CVE-2022-2421?
Low severity, with a CVSS score of 3.1, published 26 October 2022.
Which products and versions are affected?
socket.io-parser (npm) SEMVER:introduced=4.0.0,fixed=4.0.5.
Is there a fix for CVE-2022-2421?
Yes. socket.io-parser (npm): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-2421 attacked?
It is attacked over the network.
Am I affected by CVE-2022-2421?
Check whether you run socket.io-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • socket.io-parser (npm): upgrade to 4.0.5 or later
    npm install socket.io-parser@4.0.5

Technical details

The vulnerability exists in socket.io-parser's packet decoding logic, which fails to properly validate the _placeholder object type during Socket.IO packet deserialization. An attacker can craft a malicious packet with an invalid _placeholder.num value (such as array/object prototype function names like "splice" or "push", out-of-bounds numbers, or non-numeric strings) to replace expected buffer references with function references or undefined values. The attack is network-reachable and requires no authentication or user interaction; the vulnerable code path is triggered whenever the decoder processes an attacker-controlled packet. This can result in remote code execution or denial of service depending on how the application handles the injected function references. Patches are available in socket.io-parser versions 4.0.5, 4.2.1, and 3.4.2 (or 3.3.3 for older 3.x versions).

Affected products

  • Socket.IO socket.io-parser < 4.0.5, 4.1.0 to < 4.2.1, 3.0.0 to < 3.3.3, 3.4.0 to < 3.4.2

Identifiers

  • CVE-2022-2421
  • GHSA-qm95-pgcg-qqfq

Timeline

  • 2022-10-26: disclosed: GHSA and CVE published
  • 2022-10-26: patched: Patches released in socket.io-parser 4.0.5, 4.2.1, 3.4.2, and 3.3.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.