vulnwire
7.5high

CVE-2016-10518

Remote Memory Disclosure in ws

Also known as GHSA-2mhh-w6q8-5hxw

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
0
none known

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.

Exploit prediction (EPSS)

1.98% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
npmws
<1.0.1
1.0.1

Affected products

  • HackerOne ws node module

Classification

Weakness
  • CWE-201 Insertion of Sensitive Information Into Sent Data
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • github.com /websockets/ws/releases/tag/1.0.1 · x_refsource_MISC, x_transferred
  • nodesecurity.io /advisories/67 · x_refsource_MISC, x_transferred
  • gist.github.com /c0nrad/e92005446c480707a74a · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-10518 · advisory
  • github.com /websockets/ws/commit/29293ed11b679e0366fa0f6bb9310b330dafd795 · web
  • github.com /advisories/GHSA-2mhh-w6q8-5hxw · advisory
  • npmjs.com /advisories/67 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.