Denial of Service Vulnerability in Websocket-Extensions Module by Faye
CVE-2020-7662

7.5HIGH

Key Information:

Vendor

Websocket-extensions Project

Status
Websocket-extensions (npm)
Vendor
CVE Published:
2 June 2020

What is CVE-2020-7662?

The websocket-extensions npm module prior to version 0.1.4 is vulnerable to a Denial of Service (DoS) attack due to Regex Backtracking. An attacker could exploit this by sending a malicious payload that includes a Sec-WebSocket-Extensions header with a carefully crafted unclosed string parameter. This could result in substantial performance degradation on a single-threaded server by forcing the parser to take an excessive amount of time due to quadratic time complexity in addressing the repeating pattern. To mitigate this risk, users must upgrade to the latest version of the module.

Affected Version(s)

websocket-extensions (npm) All versions prior to 0.1.4

References

https://blog.jcoglan.com/2020/06/02/redos-vulnerability-i...
x_refsource_MISC
https://github.com/faye/websocket-extensions-node/securit...
x_refsource_MISC
https://github.com/faye/websocket-extensions-node/commit/...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.