CVE-2017-16129: High severity superagent vulnerability
Affected versions of superagent do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable to a ZIP bomb attack, where an extremely small ZIP file becomes many orders of magnitude larger when decompressed.
This may result in unrestrained CPU/Memory/Disk consumption, causing a denial of service condition.
Recommendation
Update to version 3.7.0 or later.
Other sources
Node.js superagent module is vulnerable to a denial of service, caused by a ZIP bomb attack. By sending a specially crafted response, a remote attacker could exploit this vulnerability to consume all available CPU resources.
— IBM
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2017-16129.
What is the severity of CVE-2017-16129?
The severity of CVE-2017-16129 is high (5.9).
How does the ZIP bomb attack affect the vulnerable software?
The ZIP bomb attack affects the vulnerable software by exploiting a lack of post-decompression size checking of ZIP compressed HTTP responses. This allows an extremely small ZIP file to become many orders of magnitude larger when decompressed, leading to a denial of service (DoS) condition.
Which versions of the superagent module are affected by CVE-2017-16129?
Versions up to but excluding 3.7.0 of the superagent module are affected by CVE-2017-16129.
How can I fix CVE-2017-16129?
To fix CVE-2017-16129, update the superagent module to version 3.7.0 or higher.