Executive brief
Soketi, a high-performance WebSockets server, was affected by a malicious update in one of its underlying software dependencies. This update causes the server to output infinite loops of garbled text, leading to an immediate crash and denial of service. Organizations using the NPM-based installation are at risk of complete service outages, while Docker-based installations are generally unaffected.
Technical details
The vulnerability stems from a supply chain attack on the 'colors.js' library, a dependency used by the Soketi WebSockets server. A malicious update to the dependency introduced an infinite loop that generates 'Zalgo' text (corrupted-looking Unicode characters) to the console, which exhausts system resources and crashes the Node.js process. This results in a complete Denial of Service (DoS) for the server. The issue affects users who installed or updated Soketi via NPM; Docker users were largely protected due to dependency bundling at build time. The issue is resolved in Soketi version 0.26.1 by pinning or updating dependencies to safe versions.
Affected products
- soketi soketi < 0.26.1
Timeline
- 2022-01-10: advisory: Initial advisory published by maintainers
- 2022-01-10: patched: Version 0.26.1 released to address the dependency issue
- 2022-01-12: disclosed: Public disclosure via GitHub Advisory Database