CVE-2020-7693: Improper Input Validation in SocksJS-Node
Summary
CVE-2020-7693: Improper Input Validation in SocksJS-Node. Affects sockjs versions < 0.3.20. Fixed in 0.3.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The SocksJS-Node package is an npm package that provides a JavaScript implementation of the SockJS protocol. SockJS is a WebSocket emulation protocol that allows browsers to create a WebSocket-like connection to a server. It is commonly used in web applications to enable real-time communication between the client and the server. The SocksJS-Node package is widely used in Node.js applications to implement SockJS functionality. However, versions of the package before 0.3.20 are vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability in SocksJS-Node arises from the incorrect handling of the Upgrade header with the value 'websocket'. This flaw can be exploited by an attacker to crash containers hosting SockJS applications. By sending a specially crafted Upgrade header, an attacker can trigger a crash in the container, leading to a denial of service (DoS) condition. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-20.
How To Fix
Minimum fixed version
0.3.20
This is the first release that contains the fix.
npm install sockjs@0.3.20Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the SocksJS-Node package to the fixed version as soon as possible.
Conclusion
The SocksJS-Node package is vulnerable to an improper input validation issue that can be exploited to crash containers hosting SockJS applications. It is recommended to update the package to version 0.3.20 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sockjs →
FAQ
SockJS is a WebSocket emulation protocol that allows browsers to create a WebSocket-like connection to a server. It is commonly used in web applications to enable real-time communication between the client and the server.
The vulnerability allows an attacker to crash containers hosting SockJS applications, leading to a denial of service (DoS) condition.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
To fix this vulnerability, update the SocksJS-Node package to version 0.3.20 or later.
No, there is no known workaround for this vulnerability. It is crucial to update the SocksJS-Node package to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for sockjs.
