ZIP Bomb Vulnerability in Node-Superagent: A Risk of Denial of Service
Summary
CVE-2017-16129: The HTTP client module superagent is vulnerable to ZIP bomb attacks. Affects node-superagent across 2 version ranges.
< 0.20.0+dfsg-2
< ebb25ce2df65090a1bd14662298c22e19f050a77
Fixed in 0.20.0+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node-Superagent is a popular HTTP client library for Node.js, designed to simplify the process of making HTTP requests. It provides a user-friendly API for handling requests and responses, making it a go-to choice for developers. However, it is susceptible to ZIP bomb attacks, where a server responds with a highly compressed file that expands significantly upon decompression, potentially leading to resource exhaustion.
Vulnerability Detail
The vulnerability identified as CVE-2017-16129 affects the Node-Superagent package, allowing attackers to exploit the HTTP client by sending a ZIP bomb. This type of attack can cause excessive CPU and memory consumption, leading to a Denial of Service (DoS) condition. The attacker must control the URL that Superagent requests, making it critical for users to validate and sanitize input URLs to mitigate this risk.
How To Fix
Minimum fixed version
0.20.0+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-superagentTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a size limit on the responses that your application processes. For example, you can set a maximum response size in your HTTP client configuration to prevent handling excessively large responses. Here is an example of how to set a limit:
const superagent = require('superagent');
superagent.get('http://example.com') .buffer(true)
.on('response', (res) => {
if (res.headers['content-length'] > MAX_SIZE) {
console.error('Response too large!');
return;
}
// Process response
});
Conclusion
The CVE-2017-16129 vulnerability in Node-Superagent poses a significant risk of Denial of Service through ZIP bomb attacks. It is crucial for developers using this package to update to the latest version and implement best practices to safeguard their applications against such threats.
See every vulnerability recorded for node-superagent →
FAQ
A ZIP bomb is a maliciously crafted compressed file that expands to an enormous size when decompressed, potentially overwhelming the system's resources.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can determine if your application is affected.
If exploited, this vulnerability can lead to Denial of Service (DoS), causing your application to become unresponsive due to excessive resource consumption.
Implementing response size limits and validating URLs before making requests can help mitigate the risk of ZIP bomb attacks.
The CVSS score for CVE-2017-16129 is 5.9, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for node-superagent.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
