CVE-2016-10536: Medium severity socket.io client vulnerability
Affected versions of engine.io-client do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks.
The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates to false, such as undefined or null, certificate verification will be disabled.
Recommendation
Update to version 1.6.9 or later.
If you are unable to upgrade, ensure all calls to socket.io to have a rejectedUnauthorized: true flag.
Other sources
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as null, resulting in certificate verification being turned off.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-10536?
CVE-2016-10536 is a vulnerability in engine.io-client that allows man-in-the-middle attacks due to the lack of certificate verification.
How does CVE-2016-10536 impact engine.io-client?
CVE-2016-10536 allows attackers to perform man-in-the-middle attacks by bypassing certificate verification in engine.io-client.
What is the severity of CVE-2016-10536?
CVE-2016-10536 has a severity value of 5.9, which is considered medium.
How can I fix CVE-2016-10536 in engine.io-client?
To fix CVE-2016-10536 in engine.io-client, upgrade to version 1.6.9 or later.
What is the Common Weakness Enumeration (CWE) for CVE-2016-10536?
The CWE for CVE-2016-10536 is CWE-300 (Channel Accessible by Non-Endpoint), and CWE-295 (Improper Certificate Validation).