CVE-2024-21522: audify Improper Validation of Array Index
Summary
CVE-2024-21522: audify vulnerable to Improper Validation of Array Index. Affects audify versions < 1.9.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Audify is an npm package used for audio decoding and playback. It provides functions to decode audio frames using the Opus codec. The package is vulnerable to an Improper Validation of Array Index issue when the frameSize parameter is provided to the new OpusDecoder().decode or new OpusDecoder().decodeFloat functions. The package does not check for negative values of frameSize, which can lead to a process crash.
Vulnerability Detail
The vulnerability arises from the lack of validation for negative values of frameSize in the audify package. When a negative frameSize is provided, it can cause the application to crash. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) attack by providing a negative frameSize value. The impact of this vulnerability is a process crash, which can disrupt the availability of the affected application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually validate the frameSize parameter before calling the vulnerable functions. Here's an example of how to perform the validation in JavaScript:
function decodeAudio(frameSize) {
if (frameSize < 0) {
throw new Error('Invalid frameSize');
}
// Call the vulnerable audify function
new OpusDecoder().decode(frameSize);
}
Conclusion
The audify package is vulnerable to an Improper Validation of Array Index issue, which can lead to a process crash. It is recommended to update the package to fix this vulnerability by implementing proper validation of the frameSize parameter. In the meantime, users can apply a temporary workaround by manually validating the frameSize parameter before calling the vulnerable functions.
See every vulnerability recorded for audify →
FAQ
The impact of this vulnerability is a process crash, which can disrupt the availability of the affected application.
An attacker can exploit this vulnerability by providing a negative frameSize value, causing the application to crash and potentially leading to a denial of service (DoS) attack.
Yes, the fix for this vulnerability involves implementing proper validation of the frameSize parameter in the audify package.
Yes, all versions of the audify package up to and including version 1.9.0 are affected by this vulnerability.
Yes, a temporary workaround is to manually validate the frameSize parameter before calling the vulnerable functions.
