GHSA-hhr9-rh25-hvf9

Suggest an improvement
Source
https://github.com/advisories/GHSA-hhr9-rh25-hvf9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-hhr9-rh25-hvf9/GHSA-hhr9-rh25-hvf9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hhr9-rh25-hvf9
Aliases
Related
Published
2023-07-20T14:54:30Z
Modified
2023-11-08T04:13:03.762779Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Feathers socket handler allows abusing implicit toString
Details

Impact

Feathers socket handler did not catch invalid string conversion errors like:

const message = `${{ toString: '' }}`

Causing the NodeJS process to crash when sending an unexpected Socket.io message like

socket.emit('find', { toString: '' })

Patches

A fix has been released in

  • v5.0.8 via #3241
  • v4.5.18 via #3242

Workarounds

Since it is in the core Socket handling code upgrading to the latest version is necessary.

References

Database specific 
{
    "github_reviewed_at": "2023-07-20T14:54:30Z",
    "cwe_ids": [
        "CWE-754"
    ],
    "nvd_published_at": "2023-07-19T20:15:10Z",
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

npm / @feathersjs/socketio

Package

Name
@feathersjs/socketio
View open source insights on deps.dev
Purl
pkg:npm/%40feathersjs/socketio

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.5.18

Database specific 

{
    "last_known_affected_version_range": "<= 4.5.17"
}

npm / @feathersjs/socketio

Package

Name
@feathersjs/socketio
View open source insights on deps.dev
Purl
pkg:npm/%40feathersjs/socketio

Affected ranges

Type
SEMVER
Events
Introduced
5.0.0
Fixed
5.0.8

Database specific 

{
    "last_known_affected_version_range": "<= 5.0.7"
}

npm / @feathersjs/transport-commons

Package

Name
@feathersjs/transport-commons
View open source insights on deps.dev
Purl
pkg:npm/%40feathersjs/transport-commons

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.5.18

Database specific 

{
    "last_known_affected_version_range": "<= 4.5.17"
}

npm / @feathersjs/transport-commons

Package

Name
@feathersjs/transport-commons
View open source insights on deps.dev
Purl
pkg:npm/%40feathersjs/transport-commons

Affected ranges

Type
SEMVER
Events
Introduced
5.0.0
Fixed
5.0.8

Database specific 

{
    "last_known_affected_version_range": "<= 5.0.7"
}