Executive brief
node-opcua is an OPC UA server/client library used in industrial automation and IoT systems to enable machine-to-machine communication. An attacker can exploit this vulnerability by sending multiple CloseSession requests with specific parameters, causing excessive memory consumption that renders the server unresponsive and disrupts critical operations or data collection from connected devices.
Technical details
The vulnerability is a denial of service (DoS) attack via uncontrolled resource consumption (CWE-400). An attacker can bypass memory consumption limitations by repeatedly sending CloseSession requests with the deleteSubscription parameter set to False, causing the node-opcua server to exhaust available memory. The attack requires network access to the OPC UA server but no authentication or user interaction. A successful exploit results in service unavailability. The vulnerability was patched in version 2.74.0, released in August 2022.
Affected products
- node-opcua node-opcua before 2.74.0
Timeline
- 2022-08-25: disclosed
- 2022-08-13: patched: Fix merged in PR #1182