CVE-2020-7662: Regular Expression Denial of Service in websocket-extensions (NPM package)
Summary
CVE-2020-7662: Regular Expression Denial of Service in websocket-extensions (NPM package). Affects websocket-extensions versions < 0.1.4. Fixed in 0.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The websocket-extensions package is an npm package that provides functionality for WebSocket extensions. WebSocket extensions are optional features that can be used to enhance the capabilities of the WebSocket protocol. These extensions can modify the behavior of the WebSocket communication between the client and the server. However, a vulnerability has been identified in the websocket-extensions package that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability, known as Regular Expression Denial of Service (ReDoS), allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request with a specific header. The header contains an unclosed string parameter value that consists of a repeating two-byte sequence of a backslash and another character. The parser takes exponential time to reject this header as invalid, causing the server to block the processing of any other work on the same thread. This can render the service completely unavailable, especially in single-threaded server environments. The impact of this vulnerability is high, with a CVSS score of 8.2.
How To Fix
Minimum fixed version
0.1.4
This is the first release that contains the fix.
npm install websocket-extensions@0.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a temporary workaround is to disable any public-facing WebSocket functionality that is being operated. By disabling WebSocket functionality, the server will not be vulnerable to the ReDoS attack. However, this workaround may impact the functionality and features provided by the WebSocket extensions.
Conclusion
The websocket-extensions package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. Users should upgrade to version 0.1.4 of the package to fix this vulnerability. If immediate upgrade is not possible, disabling public-facing WebSocket functionality can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for websocket-extensions →
FAQ
The websocket-extensions package is an npm package that provides functionality for WebSocket extensions. These extensions can enhance the capabilities of the WebSocket protocol.
Regular Expression Denial of Service (ReDoS) is a vulnerability that allows an attacker to exploit the exponential time complexity of certain regular expressions, leading to a denial of service attack.
The vulnerability can render the service completely unavailable by exhausting the server's capacity to process incoming requests. This can have a significant impact on the availability of the service.
To fix this vulnerability, upgrade to version 0.1.4 of the websocket-extensions package. This version includes a patch that addresses the vulnerability.
A temporary workaround is to disable any public-facing WebSocket functionality that is being operated. However, this may impact the functionality provided by the WebSocket extensions.
References
Related vulnerabilities
Recent vulnerabilities recorded for websocket-extensions.
