CVE-2024-37890: websockets ws denial of service via excessive HTTP headers

CVE-2024-37890 · Severity: high · CVSS 7.5 · Published 2024-06-17

The 'ws' library, a popular WebSocket implementation for Node.js, is vulnerable to a denial-of-service attack. An attacker can crash a server by sending a specially crafted request containing more HTTP headers than the server is configured to handle. This results in a service outage, preventing legitimate users from connecting to the application.

Quick answers

Is CVE-2024-37890 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-37890 being exploited in the wild.
How severe is CVE-2024-37890?
High severity, with a CVSS score of 7.5, published 17 June 2024.
Which products and versions are affected?
websockets ws >= 2.1.0, < 5.2.4; >= 6.0.0, < 6.2.3; >= 7.0.0, < 7.5.10; >= 8.0.0, < 8.17.1.
Is there a fix for CVE-2024-37890?
A patch was published on 2024-06-16: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-37890 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-37890?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in the 'ws' library due to improper handling of HTTP requests where the number of headers exceeds the 'server.maxHeadersCount' threshold. When this limit is reached, Node.js may emit an 'upgrade' event but fail to populate the 'upgrade' property in the request headers object. The 'ws' library subsequently attempts to call '.toLowerCase()' on this undefined property, resulting in a TypeError that crashes the Node.js process. This is reachable by unauthenticated remote attackers via a standard network request. The issue has been patched in versions 5.2.4, 6.2.3, 7.5.10, and 8.17.1 by ensuring the handshake is safely aborted if the header cannot be validated.

Affected products

  • websockets ws >= 2.1.0, < 5.2.4; >= 6.0.0, < 6.2.3; >= 7.0.0, < 7.5.10; >= 8.0.0, < 8.17.1

Identifiers

  • CVE-2024-37890
  • GHSA-3h5v-q93c-6h6q

Timeline

  • 2024-06-15: disclosed: Issue reported on GitHub
  • 2024-06-16: patched: Fix merged into master branch
  • 2024-06-17: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.