Memory Allocation Vulnerability in node-ws
Summary
CVE-2016-10518: A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. Affects node-ws across 2 version ranges.
< 1.0.1+ds1.e6ddaae4-1
< 40a9d686288b5d0be13f2bf2f3f5da07afc8cda2
Fixed in 1.0.1+ds1.e6ddaae4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-ws package is a WebSocket implementation for Node.js. It provides a simple and efficient way to establish WebSocket connections and handle communication between clients and servers. However, a vulnerability has been discovered in the ping functionality of the ws module before version 1.0.0. This vulnerability allows clients to allocate memory by sending a ping frame, which can lead to resource exhaustion and potential denial-of-service attacks.
Vulnerability Detail
The vulnerability arises from the ws module's handling of ping frames. By default, when a ping frame is received, the module responds with a pong frame containing the payload of the ping frame. However, internally, the module transforms all data to a Buffer instance without performing proper checks. This allows an attacker to send a ping frame with a payload that triggers memory allocation based on the payload's length. If the payload is specified as a number instead of a string, the module will allocate the corresponding number of bytes, potentially leading to excessive memory usage.
How To Fix
Minimum fixed version
1.0.1+ds1.e6ddaae4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-wsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update to the fixed version, a temporary workaround is to disable the ping functionality in your application. This can be achieved by setting the 'ping' option to 'false' when creating the WebSocket server or client. However, keep in mind that this workaround will prevent the use of ping-pong heartbeats for monitoring the connection status.
Conclusion
In conclusion, the node-ws package prior to version 1.0.1 is vulnerable to a memory allocation issue in its ping functionality. This can be exploited by sending specially crafted ping frames, leading to excessive memory usage and potential denial-of-service attacks. It is crucial to update to the fixed version or apply the recommended workaround to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-ws →
FAQ
This vulnerability allows an attacker to allocate excessive memory on the server hosting the vulnerable application. This can lead to resource exhaustion, potentially resulting in denial-of-service attacks and disruption of service availability.
If your application uses a version of the node-ws package prior to 1.0.1, it is vulnerable to this issue. It is recommended to update to the fixed version as soon as possible.
Yes, this vulnerability can be exploited remotely by sending specially crafted ping frames to the WebSocket server.
The recommended mitigation is to update the node-ws package to version 1.0.1 or later. Disabling the ping functionality can also serve as a temporary workaround.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-ws.
