npm ws denial of service via Sec-WebSocket-Extensions header

Executive brief

The 'ws' library, a popular WebSocket implementation for Node.js, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted network request that causes the server to crash. This can lead to service outages and prevent legitimate users from accessing the application.

Technical details

A denial-of-service (DoS) vulnerability exists in the 'ws' library due to improper handling of the 'Sec-WebSocket-Extensions' HTTP header. The root cause is uncontrolled resource consumption (CWE-400) when the library processes header values containing 'Object.prototype' property names (e.g., 'constructor'). A remote, unauthenticated attacker can exploit this by sending a crafted GET request during the WebSocket upgrade handshake, triggering a process crash. This affects versions 0.6.0 through 1.1.4 and 2.0.0 through 3.3.0. The issue is resolved in versions 1.1.5 and 3.3.1.

Affected products

• npm ws >= 0.6.0, < 1.1.5; >= 2.0.0, < 3.3.1

Timeline

• 2019-06-04: disclosed
• 2019-06-04: advisory

References

• https://api.github.com/users/RainSignal
• https://github.com/RainSignal
• https://api.github.com/users/RainSignal/gists%7B/gist_id%7D
• https://api.github.com/users/RainSignal/repos
• https://avatars.githubusercontent.com/u/101503193?v=4
• https://api.github.com/users/RainSignal/events%7B/privacy%7D