Is CVE-2023-32695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-32695 being exploited in the wild.

How severe is CVE-2023-32695?

Low severity, with a CVSS score of 3.1, published 23 May 2023.

Which products and versions are affected?

socket.io-parser (npm) SEMVER:introduced=4.0.4,fixed=4.2.3.

Is there a fix for CVE-2023-32695?

Yes. socket.io-parser (npm): upgrade to 4.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-32695 attacked?

It is attacked over the network.

Am I affected by CVE-2023-32695?

Check whether you run socket.io-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-32695: Socket.IO Parser insufficient input validation denial of service

CVE-2023-32695 · Severity: low · CVSS 3.1 · Published 2023-05-23

Socket.IO Parser is a JavaScript library that handles real-time bidirectional communication packets for Node.js applications. A malformed Socket.IO packet can cause an uncaught exception that crashes the entire Node.js process, resulting in service outage and potential data loss for connected clients.

Technologies: socket.io-parser (npm). Vendors: npm.

Quick answers

Is CVE-2023-32695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-32695 being exploited in the wild.
How severe is CVE-2023-32695?: Low severity, with a CVSS score of 3.1, published 23 May 2023.
Which products and versions are affected?: socket.io-parser (npm) SEMVER:introduced=4.0.4,fixed=4.2.3.
Is there a fix for CVE-2023-32695?: Yes. socket.io-parser (npm): upgrade to 4.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-32695 attacked?: It is attacked over the network.
Am I affected by CVE-2023-32695?: Check whether you run socket.io-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

socket.io-parser (npm): upgrade to 4.2.3 or later
```
npm install socket.io-parser@4.2.3
```

Technical details

A specially crafted Socket.IO packet fails validation during decoding and triggers a TypeError ("Cannot convert object to primitive value") in the Socket.IO event emitter, causing an uncaught exception that terminates the Node.js process. The vulnerability exists in socket.io-parser versions 4.0.4–4.2.2, 3.4.0–3.4.2, and all earlier versions prior to 3.3.4. No authentication or special privileges are required; an attacker on the network can send a malicious packet directly to the server. Patches were released on 2023-05-22 in socket.io-parser 4.2.3, 3.4.3, and 3.3.4.

Affected products

Socket.IO socket.io-parser 4.0.4–4.2.2, 3.4.0–3.4.2, and prior versions before 3.3.4

Identifiers

CVE-2023-32695
GHSA-cqmj-92xf-r6r9

Timeline

2023-05-22: disclosed: Advisory published and patches released
2023-05-22: patched: Fixes in socket.io-parser 4.2.3, 3.4.3, and 3.3.4

References

https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.