GitStock

feathersjs/feathers · Security

Feathers socket handler allows abusing implicit toString

GHSA ID
GHSA-hhr9-rh25-hvf9
CVE ID
CVE-2023-37899
Severity
high
Published
Updated
CVSS
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Impact

Feathers socket handler did not catch invalid string conversion errors like:

const message = `${{ toString: '' }}`

Causing the NodeJS process to crash when sending an unexpected Socket.io message like

socket.emit('find', { toString: '' })

Patches

A fix has been released in

  • v5.0.8 via #3241
  • v4.5.18 via #3242

Workarounds

Since it is in the core Socket handling code upgrading to the latest version is necessary.

References

CWEs

  • CWE-754 · Improper Check for Unusual or Exceptional Conditions

References

Open GitHub