- Module:
ws
- Published: May 28th 2021
- Reported by: Anonymous
- CWE-400
- CVE-2021-32640
- Vulnerable: >=5.0.0 <5.2.3 || >=6.0.0 <6.2.2 || >=7.0.0 <7.4.6
- Patched: >=5.2.3 <6.0.0 || >=6.2.2 <7.0.0 || >=7.4.6
- Exploitability: 5
Overview
In ws before versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability.
Impact
A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.
Proof of concept
for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
const value = 'b' + ' '.repeat(length) + 'x';
const start = process.hrtime.bigint();
value.trim().split(/
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}
Patches
The vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff).
Workarounds
In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.
Credits
The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.
Findings
- jest>jest-cli>jest-config>jest-environment-jsdom>jsdom>ws
- jest>jest-cli>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws
- jest>jest-cli>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws
- jest>jest-cli>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws
- jest>jest-cli>jest-environment-jsdom>jsdom>ws
- jest-environment-jsdom>jsdom>ws
- jest-enzyme>jest-environment-enzyme>jest-environment-jsdom>jsdom>ws
Remediation
Upgrade to version 5.2.3 or 6.2.2 or 7.4.6 or later
References