Junglewise Threat Intelligence

CVE-2024-37890: websockets ws denial of service via excessive HTTP headers

CVE-2024-37890 · Severity: high · CVSS 7.5 · Published 2024-06-17

Technologies: Websockets Ws.

Executive brief

The 'ws' library, a popular WebSocket implementation for Node.js, is vulnerable to a denial-of-service attack. An attacker can crash a server by sending a specially crafted request containing more HTTP headers than the server is configured to handle. This results in a service outage, preventing legitimate users from connecting to the application.

Technical details

A denial-of-service vulnerability exists in the 'ws' library due to improper handling of HTTP requests where the number of headers exceeds the 'server.maxHeadersCount' threshold. When this limit is reached, Node.js may emit an 'upgrade' event but fail to populate the 'upgrade' property in the request headers object. The 'ws' library subsequently attempts to call '.toLowerCase()' on this undefined property, resulting in a TypeError that crashes the Node.js process. This is reachable by unauthenticated remote attackers via a standard network request. The issue has been patched in versions 5.2.4, 6.2.3, 7.5.10, and 8.17.1 by ensuring the handshake is safely aborted if the header cannot be validated.

Affected products

  • websockets ws >= 2.1.0, < 5.2.4; >= 6.0.0, < 6.2.3; >= 7.0.0, < 7.5.10; >= 8.0.0, < 8.17.1

Timeline

  • 2024-06-15: disclosed: Issue reported on GitHub
  • 2024-06-16: patched: Fix merged into master branch
  • 2024-06-17: advisory: GitHub Security Advisory published

References