websockets ws up to 5.2.3/6.2.2/7.5.9/8.17.0 on Node.js Request Header null pointer dereference

Summaryinfo

A vulnerability identified as problematic has been detected in websockets ws up to 5.2.3/6.2.2/7.5.9/8.17.0 on Node.js. This affects an unknown function of the component Request Header Handler. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2024-37890. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in websockets ws up to 5.2.3/6.2.2/7.5.9/8.17.0 on Node.js. It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component Request Header Handler. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. The summary by CVE is:

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-37890 since 06/10/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 209625 (Fedora 39 : yarnpkg (2024-d79685d847)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.2.4, 6.2.3, 7.5.10 or 8.17.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (209625). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• JavaScript Library

Vendor

• websockets

Name

• ws

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 6.2.0
• 6.2.1
• 6.2.2
• 7.5.0
• 7.5.1
• 7.5.2
• 7.5.3
• 7.5.4
• 7.5.5
• 7.5.6
• 7.5.7
• 7.5.8
• 7.5.9
• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6
• 8.7
• 8.8
• 8.9
• 8.10
• 8.11
• 8.12
• 8.13
• 8.14
• 8.15
• 8.16
• 8.17.0

Website

• Product: https://github.com/websockets/ws/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion