CVE-2023-37899GHSA-HHR9-RH25-HVF9
feathersjs socket handler allows abusing implicit toString
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.5.18, 5.0.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- feathersjs feathers
fixed in 4.5.18; From 5.0.0 · fixed in 5.0.8
- @feathersjs/socketionpm
fixed in 4.5.18
- @feathersjs/socketionpm
From 5.0.0 · fixed in 5.0.8
- @feathersjs/transport-commonsnpm
fixed in 4.5.18
- @feathersjs/transport-commonsnpm
From 5.0.0 · fixed in 5.0.8