Executive brief
floody is a Node.js library used to manage high-frequency data streams. A security flaw in older versions allows the library to accidentally expose fragments of the server's internal memory. This could lead to the leakage of sensitive information, such as passwords, private keys, or customer data, if an attacker can influence the data being written to a stream.
Technical details
Versions of floody before 0.1.1 are vulnerable to uninitialized memory exposure (CWE-201). The vulnerability exists in the `.write()` method, which passes input directly to the `Buffer` constructor. In Node.js versions <= 4, passing a number to `new Buffer(number)` allocates a buffer of that size without zero-filling it, thereby including whatever data was previously stored in that memory space. If an attacker can provide a numeric value to the write function and subsequently view the output stream, they can read fragments of process memory. This has been patched in version 0.1.1 by ensuring input is cast to a string before buffer allocation.
Affected products
- soldair floody < 0.1.1
Timeline
- 2016-01-15: disclosed: Vulnerability reported by ChALkeR
- 2016-01-15: patched: Fix committed to GitHub repository
- 2019-06-04: advisory: GitHub Advisory published