Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-Q9MW-68C2-J6M5
HistoryMay 03, 2023 - 9:56 p.m.

engine.io Uncaught Exception vulnerability

2023-05-0321:56:51
CWE-248
GitHub Advisory Database
github.com
12
http request
node.js
vulnerability
package
socket.io
upgrade
security advisory
responsible disclosure
engine.io
codean

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

57.0%

JSON

Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

TypeError: Cannot read properties of undefined (reading 'handlesUpgrades')
    at Server.onWebSocket (build/server.js:515:67)

This impacts all the users of the engine.io package, including those who uses depending packages like socket.io.

Patches

A fix has been released today (2023/05/02): 6.4.2

This bug was introduced in version 5.1.0 and included in version 4.1.0 of the socket.io parent package. Older versions are not impacted.

For socket.io users:

Version range engine.io version Needs minor update?
[email protected] ~6.4.0 npm audit fix should be sufficient
[email protected] ~6.2.0 Please upgrade to [email protected]
[email protected] ~6.1.0 Please upgrade to [email protected]
[email protected] ~6.0.0 Please upgrade to [email protected]
[email protected] ~5.2.0 Please upgrade to [email protected]
[email protected] ~5.1.1 Please upgrade to [email protected]
[email protected] ~5.0.0 Not impacted
[email protected] ~4.1.0 Not impacted
[email protected] ~4.0.0 Not impacted
[email protected] ~3.6.0 Not impacted
[email protected] and below ~3.5.0 Not impacted

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

Thanks to Thomas Rinsma from Codean for the responsible disclosure.

Affected configurations

Vulners
Node
socketengine.ioRange5.1.0≥
OR
socketengine.ioRange<6.4.2
CPENameOperatorVersion
engine.ioge5.1.0
engine.iolt6.4.2

Related

prion 1
osv 2
veracode 1
redhatcve 1
cvelist 1
nvd 1
cve 1
ibm 5
nessus 1
prion
prion
Cross site scripting
2023-05-08 21:15:00
osv
osv
CVE-2023-31125
2023-05-08 21:15:11
engine.io Uncaught Exception vulnerability
2023-05-03 21:56:51
veracode
veracode
Denial Of Services (DoS)
2023-05-11 02:47:06
redhatcve
redhatcve
CVE-2023-31125
2023-05-15 08:22:01
cvelist
cvelist
CVE-2023-31125 Uncaught exception in engine.io
2023-05-08 20:21:01
nvd
nvd
CVE-2023-31125
2023-05-08 21:15:11
cve
cve
CVE-2023-31125
2023-05-08 21:15:11
ibm
ibm
Security Bulletin: Decision Optimization in IBM Cloud Pak for Data is vulnerable to Engine.IO denial of service (CVE-2023-31125)
2023-09-08 08:47:06
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service due to [CVE-2023-31125]
2023-06-01 14:39:41
Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.11 and earlier
2023-06-20 15:24:05
nessus
nessus
Fedora 39 : magicmirror (2023-3a06c965b4)
2023-11-07 00:00:00

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

57.0%

JSON
Related for GHSA-Q9MW-68C2-J6M5
prion1osv2veracode1redhatcve1cvelist1nvd1cve1ibm5nessus1