Lucene search
Veracode Vulnerability DatabaseVERACODE:37730HistoryNov 01, 2022 - 5:10 a.m.
Type Confusion
2022-11-0105:10:53
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
socket.io-parser
type confusion
vulnerability
type validation
attachment parsing
reconstructpacket
query object
security issue
0.002 Low
EPSS
Percentile
59.3%
socket.io-parser is vulnerable to type confusion. It is possible to overwrite the _placeholder object due to improper type validation of attachment parsing in the _reconstructPacket function, which allows an attacker to place references to functions at arbitrary places in the resulting query object.
References
csirt.divd.nl/cases/DIVD-2022-00045
csirt.divd.nl/cases/DIVD-2022-00045/
csirt.divd.nl/CVE-2022-2421
csirt.divd.nl/cves/CVE-2022-2421
csirt.divd.nl/cves/CVE-2022-2421/
csirt.divd.nl/DIVD-2022-00045
github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4
github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050
Related
prion
prion
Input validation
2022-10-26 10:15:00
osv
osv
CVE-2022-2421
2022-10-26 10:15:16
Insufficient validation when decoding a Socket.IO packet
2022-10-26 12:00:28
nvd
nvd
CVE-2022-2421
2022-10-26 10:15:16
github
github
Insufficient validation when decoding a Socket.IO packet
2022-10-26 12:00:28
ibm
ibm
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to arbitrary code execution due to CVE-2022-2421
2022-11-04 17:33:30
cve
cve
CVE-2022-2421
2022-10-26 10:15:16
cvelist
cvelist
CVE-2022-2421 Socket.io - Improper type validation in attachment parsing
2022-10-25 00:00:00