Denial of Service Vulnerability in ammo
Summary
GHSA-mg85-8mv5-ffjr: Denial of Service in ammo. Affects ammo versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ammo package is an open-source library used for parsing HTTP headers in Node.js applications. It is commonly used in conjunction with the hapi framework. The package is responsible for handling the Range HTTP header, which specifies the range of bytes requested in a resource. However, all versions of ammo are vulnerable to a Denial of Service (DoS) attack. This vulnerability arises from a flaw in the Range HTTP header parser, which throws a system error if the header is set to an invalid value. As hapi does not expect this function to throw an error, it propagates up the stack and can lead to the application crashing if no unhandled exception handler is present. This vulnerability allows an attacker to exploit the flaw and disrupt the services provided by the application.
Vulnerability Detail
The Denial of Service vulnerability in ammo arises from the improper handling of the Range HTTP header. By setting an invalid value for this header, an attacker can trigger a system error that propagates up the stack, potentially causing the application to crash. This can lead to a complete disruption of services provided by the application. The vulnerability affects all versions of ammo.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the dependencies is not immediately feasible, a temporary workaround can be implemented. The workaround involves implementing a custom exception handler in the application to catch the system error thrown by the vulnerable ammo package. By handling the exception, the application can prevent it from propagating up the stack and crashing the services. Here is an example of how the custom exception handler can be implemented in a Node.js application:
process.on('uncaughtException', (err) => {
// Handle the exception here
});
Conclusion
The Denial of Service vulnerability in the ammo package can be exploited by setting an invalid value for the Range HTTP header. This can lead to a system error and potentially crash the application, resulting in a disruption of services. To mitigate this vulnerability, it is recommended to update the dependencies of the affected application to use the maintained package @hapi/ammo. Alternatively, a temporary workaround can be implemented by adding a custom exception handler in the application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ammo →
FAQ
The vulnerability allows an attacker to trigger a system error in the ammo package, potentially causing the application to crash. This can result in a complete disruption of services provided by the application.
All versions of ammo are vulnerable to this Denial of Service vulnerability.
Yes, the vulnerability can be fixed by updating the dependencies of the affected application to use the maintained package @hapi/ammo.
A temporary workaround involves implementing a custom exception handler in the application to catch the system error thrown by the vulnerable ammo package.
You can find more information about the vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-mg85-8mv5-ffjr/GHSA-mg85-8mv5-ffjr.json
