Executive brief
lite-web-server is a lightweight HTTP file server library for Node.js. An attacker can crash the server by sending HTTP requests with control characters that the URI decoder cannot parse, resulting in service unavailability and potential application downtime.
Technical details
The vulnerability is an unhandled exception in the URI decoding logic. The vulnerable code on line 274 of src/WebServer.js calls decodeURIComponent() on the request URL without exception handling. When an attacker sends an HTTP request containing control characters or invalid Unicode sequences (e.g., %c0%2f), the decodeURIComponent() function throws an unhandled exception that crashes the entire server process. The attack requires no authentication and is remotely exploitable over the network. An attacker can exploit this by sending a single malformed request to cause immediate denial of service.
Affected products
- <UNKNOWN> lite-web-server all versions up to and including 1.2.2
Timeline
- 2023-02-25: disclosed: CVE-2023-26104 published