Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1xbTk1LXBnY2ctcXFmcc4AAvix

Insufficient validation when decoding a Socket.IO packet

Due to improper type validation in the socket.io-parser library (which is used by the socket.io and socket.io-client packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Example:

const decoder = new Decoder();

decoder.on("decoded", (packet) => {
 console.log(packet.data); // prints [ 'hello', [Function: splice] ]
})

decoder.add('51-["hello",{"_placeholder":true,"num":"splice"}]');
decoder.add(Buffer.from("world"));

This bubbles up in the socket.io package:

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // here, "val" could be a function instead of a buffer
 });
});

⚠️ IMPORTANT NOTE ⚠️

You need to make sure that the payload that you received from the client is actually a Buffer object:

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 if (!Buffer.isBuffer(val)) {
 socket.disconnect();
 return;
 }
 // ...
 });
});

If that's already the case, then you are not impacted by this issue, and there is no way an attacker could make your server crash (or escalate privileges, ...).

Example of values that could be sent by a malicious user:

Sample packet: 451-["hello",{"_placeholder":true,"num":10}]

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // val is `undefined`
 });
});

Sample packet: 451-["hello",{"_placeholder":true,"num":undefined}]

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // val is `undefined`
 });
});

Sample packet: 451-["hello",{"_placeholder":true,"num":"push"}]

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // val is a reference to the "push" function
 });
});

Sample packet: 451-["hello",{"_placeholder":true,"num":"hasOwnProperty"}]

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // val is a reference to the "hasOwnProperty" function
 });
});

This should be fixed by:

Dependency analysis for the socket.io package

socket.io version socket.io-parser version Covered?
4.5.2...latest ~4.2.0 (ref) Yes ✔️
4.1.3...4.5.1 ~4.0.4 (ref) Yes ✔️
3.0.5...4.1.2 ~4.0.3 (ref) Yes ✔️
3.0.0...3.0.4 ~4.0.1 (ref) Yes ✔️
2.3.0...2.5.0 ~3.4.0 (ref) Yes ✔️

Dependency analysis for the socket.io-client package

socket.io-client version socket.io-parser version Covered?
4.5.0...latest ~4.2.0 (ref) Yes ✔️
4.3.0...4.4.1 ~4.1.1 (ref) No, but the impact is very limited
3.1.0...4.2.0 ~4.0.4 (ref) Yes ✔️
3.0.5 ~4.0.3 (ref) Yes ✔️
3.0.0...3.0.4 ~4.0.1 (ref) Yes ✔️
2.2.0...2.5.0 ~3.3.0 (ref) Yes ✔️
Permalink: https://github.com/advisories/GHSA-qm95-pgcg-qqfq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xbTk1LXBnY2ctcXFmcc4AAvix
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 2 years ago
Updated: 9 months ago


CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.0021
EPSS Percentile: 0.5857

Identifiers: GHSA-qm95-pgcg-qqfq, CVE-2022-2421
References: Repository: https://github.com/socketio/socket.io-parser
Blast Radius: 59.8

Affected Packages

npm:socket.io-parser
Dependent packages: 303
Dependent repositories: 1,259,292
Downloads: 26,984,256 last month
Affected Version Ranges: >= 3.4.0, < 3.4.2, < 3.3.3, >= 4.0.0, < 4.0.5, >= 4.1.0, < 4.2.1
Fixed in: 3.4.2, 3.3.3, 4.0.5, 4.2.1
All affected versions: 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 2.0.0, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.3.0, 2.3.1, 2.3.2, 3.0.0, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.3.0, 3.3.1, 3.3.2, 3.4.0, 3.4.1, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.2.0
All unaffected versions: 3.3.3, 3.3.4, 3.4.2, 3.4.3, 4.0.5, 4.2.1, 4.2.2, 4.2.3, 4.2.4