Lucene search

HackeroneCVE-2017-16025

HistoryJun 04, 2018 - 7:29 p.m.

CVE-2017-16025

2018-06-0419:29:01

CWE-400

CWE-287

hackerone

web.nvd.nist.gov

cve-2017-16025

nes

websocket

hapi

denial of service

vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.002

Percentile

58.3%

JSON

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to cookie. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.

Affected configurations

Nvd

Vulners

Node

hapijsnesRange≤6.4.0node.js

VendorProductVersionCPE
hapijsnes*cpe:2.3:a:hapijs:nes:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
hapijs	nes	*	cpe:2.3:a:hapijs:nes::::::node.js::*

CNA Affected

[
  {
    "product": "nes node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "<=6.4.0"
      }
    ]
  }
]

References

github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655

github.com/hapijs/nes/issues/171

nodesecurity.io/advisories/331

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.002

Percentile

58.3%

JSON

Related for CVE-2017-16025