CVE-2024-38355

Aliases:GHSA-25hc-qcg6-38wj
Advisory lineage Upstream: 0 Downstream: 1
Deferred
Published: 19 Jun 2024, 19:48
Last modified:03 Sept 2024, 20:35

Vulnerability Summary

Overall Risk (default)
medium
29/100
CVSS Score
7.3 HIGH
v3.1 (cve.org)
EPSS Score
0.69% LOW
1% probability +0.55%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Jun 2024, 19:48
Published
Vulnerability first disclosed
03 Sept 2024, 20:35
Last Modified
Vulnerability information updated

Description

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Trends

Current EPSS score: 0.69%• Percentile: 48%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  • CWE-754•Improper Check for Unusual or Exceptional Conditions

    The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Affected Systems

  • Npm•socket.io

    < 2.5.1 | ≥ 3.0.0, < 4.6.2

  • socketio•socket.io

    < 2.5.1 | ≥ 3.0.0, < 4.6.2

References (6)