Executive brief
Socket.IO Parser is a library used to encode and decode messages in real-time communication applications. Due to insufficient validation of packet structure, an attacker can inject malicious data that causes application crashes or allows arbitrary function execution on the server, potentially compromising the application's availability and security.
Technical details
The vulnerability exists in socket.io-parser's packet decoding logic, which fails to properly validate the _placeholder object type during Socket.IO packet deserialization. An attacker can craft a malicious packet with an invalid _placeholder.num value (such as array/object prototype function names like "splice" or "push", out-of-bounds numbers, or non-numeric strings) to replace expected buffer references with function references or undefined values. The attack is network-reachable and requires no authentication or user interaction; the vulnerable code path is triggered whenever the decoder processes an attacker-controlled packet. This can result in remote code execution or denial of service depending on how the application handles the injected function references. Patches are available in socket.io-parser versions 4.0.5, 4.2.1, and 3.4.2 (or 3.3.3 for older 3.x versions).
Affected products
- Socket.IO socket.io-parser < 4.0.5, 4.1.0 to < 4.2.1, 3.0.0 to < 3.3.3, 3.4.0 to < 3.4.2
Timeline
- 2022-10-26: disclosed: GHSA and CVE published
- 2022-10-26: patched: Patches released in socket.io-parser 4.0.5, 4.2.1, 3.4.2, and 3.3.3