Improper Input Validation Affecting socket.io-parser package, versions <3.3.3>=3.4.0 <3.4.2>=4.0.0 <4.0.5>=4.1.0 <4.2.1


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.21% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-SOCKETIOPARSER-3091012
  • published30 Oct 2022
  • disclosed26 Oct 2022
  • creditThomas Rinsma

Introduced: 26 Oct 2022

CVE-2022-2421  (opens in a new tab)
CWE-89  (opens in a new tab)

How to fix?

Upgrade socket.io-parser to version 3.3.3, 3.4.2, 4.0.5, 4.2.1 or higher.

Overview

socket.io-parser is a socket.io protocol parser

Affected versions of this package are vulnerable to Improper Input Validation. when parsing attachments containing untrusted user input. Attackers can overwrite the _placeholder object to place references to functions in query objects.

PoC

const decoder = new Decoder();

decoder.on("decoded", (packet) => {
  console.log(packet.data); // prints [ 'hello', [Function: splice] ]
})

decoder.add('51-["hello",{"_placeholder":true,"num":"splice"}]');
decoder.add(Buffer.from("world"));

CVSS Scores

version 3.1