Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, with a CVSS score of 9.8, published 12 January 2022.
- Which products and versions are affected?
- @soketi/soketi (npm) SEMVER:introduced=0,fixed=0.26.1; Soketi < 0.26.1.
- Is there a fix for This vulnerability?
- Yes. @soketi/soketi (npm): upgrade to 0.26.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run @soketi/soketi (npm) or Soketi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @soketi/soketi (npm): upgrade to 0.26.1 or later
npm install @soketi/soketi@0.26.1
Technical details
The vulnerability stems from a supply chain attack on the 'colors.js' library, a dependency used by the Soketi WebSockets server. A malicious update to the dependency introduced an infinite loop that generates 'Zalgo' text (corrupted-looking Unicode characters) to the console, which exhausts system resources and crashes the Node.js process. This results in a complete Denial of Service (DoS) for the server. The issue affects users who installed or updated Soketi via NPM; Docker users were largely protected due to dependency bundling at build time. The issue is resolved in Soketi version 0.26.1 by pinning or updating dependencies to safe versions.
Affected products
- soketi soketi < 0.26.1
Timeline
- 2022-01-10: advisory: Initial advisory published by maintainers
- 2022-01-10: patched: Version 0.26.1 released to address the dependency issue
- 2022-01-12: disclosed: Public disclosure via GitHub Advisory Database