Severity: moderate

    Regular Expression Denial of Service

    ws

    Overview

    In ws before versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability.

    Impact

    A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

    Proof of concept

    for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
      const value = 'b' + ' '.repeat(length) + 'x';
      const start = process.hrtime.bigint();
     
      value.trim().split(/ **/);
     
      const end = process.hrtime.bigint();
     
      console.log('length = %d, time = %f ns', length, end - start);
    }

    Patches

    The vulnerability was fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff).

    Workarounds

    In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

    Credits

    The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

    Remediation

    Upgrade to version 5.2.3 or 6.2.2 or 7.4.6 or later

    Resources

    Have content suggestions? Visit npmjs.com/support.

    Advisory timeline

    1. published

      Advisory Published
      Jun 1st, 2021
    2. reported

      Reported by Anonymous
      May 28th, 2021