CVE-2016-10536: Insecure Defaults Allow MITM Over TLS in engine.io-client
Summary
CVE-2016-10536: Insecure Defaults Allow MITM Over TLS in engine.io-client. Affects engine.io-client versions < 1.6.9. Fixed in 1.6.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The engine.io-client package is an open-source library used for real-time communication between clients and servers. It is commonly used with socket.io, a popular JavaScript library for building real-time applications. The package provides a client-side implementation of the Engine.IO protocol, allowing bidirectional communication between the client and server. However, certain versions of engine.io-client have a vulnerability that allows for Man-in-the-Middle (MITM) attacks over TLS connections.
Vulnerability Detail
The vulnerability in engine.io-client arises from insecure defaults related to certificate verification. By default, the package does not verify certificates, making it susceptible to MITM attacks. This vulnerability is due to the way node.js handles the rejectUnauthorized setting. If this setting is not explicitly set to true, certificate verification will be disabled. An attacker could exploit this vulnerability by intercepting the TLS connection and impersonating the server, potentially gaining unauthorized access to sensitive information or tampering with the communication.
How To Fix
Minimum fixed version
1.6.9
This is the first release that contains the fix.
npm install engine.io-client@1.6.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading or modifying the code is not feasible, a temporary workaround is to manually set the rejectUnauthorized flag to true in the code where the engine.io-client library is used. For example:
const io = require('engine.io-client');
const socket = io('https://example.com', { rejectUnauthorized: true });
Conclusion
The engine.io-client package has a vulnerability that allows for Man-in-the-Middle attacks over TLS connections. It is crucial to update to version 1.6.9 or later to fix this vulnerability. If upgrading is not possible, ensure that the rejectUnauthorized flag is set to true in all calls to socket.io. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for engine.io-client →
FAQ
engine.io-client is an open-source library used for real-time communication between clients and servers. It provides a client-side implementation of the Engine.IO protocol.
The vulnerability allows for Man-in-the-Middle attacks over TLS connections. An attacker could intercept the communication and potentially gain unauthorized access to sensitive information or tamper with the data being transmitted.
To fix this vulnerability, update to version 1.6.9 or later of engine.io-client. Alternatively, ensure that all calls to socket.io have the rejectUnauthorized flag set to true.
If upgrading or modifying the code is not feasible, a temporary workaround is to manually set the rejectUnauthorized flag to true in the code where the engine.io-client library is used.
You can find more information about this vulnerability in the official GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-4r4m-hjwj-43p8/GHSA-4r4m-hjwj-43p8.json
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
