Is CVE-2024-38355 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-38355 being exploited in the wild.

How severe is CVE-2024-38355?

High severity, with a CVSS score of 7.3, published 19 June 2024.

Which products and versions are affected?

Socket.IO socket.io = 3.0.0, < 4.6.2.

Is there a fix for CVE-2024-38355?

A patch was published on 2023-05-01: Initial fix released in version 4.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-38355 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-38355?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-38355: socket.io has an unhandled 'error' event

Q: Is there a fix for CVE-2024-38355?

A patch was published on 2023-05-01: Initial fix released in version 4.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-38355 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-38355?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-38355 · Severity: high · CVSS 7.3 · Published 2024-06-19

Socket.IO is a popular framework used for real-time, bidirectional communication between web clients and servers. A vulnerability in how the server handles specific network packets allows an attacker to crash the application. This results in a denial-of-service (DoS) condition, potentially disrupting real-time services and impacting business operations.

Quick answers

Is CVE-2024-38355 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-38355 being exploited in the wild.
How severe is CVE-2024-38355?: High severity, with a CVSS score of 7.3, published 19 June 2024.
Which products and versions are affected?: Socket.IO socket.io < 2.5.1, >= 3.0.0, < 4.6.2.
Is there a fix for CVE-2024-38355?: A patch was published on 2023-05-01: Initial fix released in version 4.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-38355 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-38355?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists because the Socket.IO server does not always have a default listener for 'error' events emitted by individual sockets. In Node.js, emitting an 'error' event on an EventEmitter without at least one registered listener causes the process to throw an uncaught exception and exit. An attacker can send a specially crafted packet that triggers such an error (e.g., via invalid packet structures or middleware rejections), leading to a process crash. The fix involves adding a no-op ('noop') error listener by default to prevent these uncaught exceptions. Patches are available in versions 2.5.1 and 4.6.2.

Affected products

Socket.IO socket.io < 2.5.1, >= 3.0.0, < 4.6.2

Identifiers

CVE-2024-38355
GHSA-25hc-qcg6-38wj

Timeline

2023-05-01: patched: Initial fix released in version 4.6.2
2024-06-19: advisory: GHSA-25hc-qcg6-38wj published and fix backported to 2.x branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.