Skip to content

ReDoS in Sec-Websocket-Protocol header

Moderate
lpinca published GHSA-6fc8-4gx4-v693 May 25, 2021

Package

npm ws (npm)

Affected versions

>= 5.0.0 < 5.2.3, >= 6.0.0 < 6.2.2, >= 7.0.0 < 7.4.6

Patched versions

5.2.3, 6.2.2, 7.4.6

Description

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

Patches

The vulnerability was fixed in [email protected] (00c425e) and backported to [email protected] (78c676d) and [email protected] (76d47c1).

Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Credits

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

References

Severity

Moderate

CVE ID

CVE-2021-32640

Weaknesses

Credits