CVE-2023-32695: Insufficient validation when decoding a Socket.IO packet
First published: Tue May 23 2023(Updated: )
### Impact A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. ``` TypeError: Cannot convert object to primitive value at Socket.emit (node:events:507:25) at .../node_modules/socket.io/lib/socket.js:531:14 ``` ### Patches A fix has been released today (2023/05/22): - https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3, included in `socket.io-parser@4.2.3` - https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced, included in `socket.io-parser@3.4.3` Another fix has been released for the `3.3.x` branch: - https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4, included in `socket.io-parser@3.3.4 | `socket.io` version | `socket.io-parser` version | Needs minor update? | |---------------------|---------------------------------------------------------------------------------------------------------|--------------------------------------| | `4.5.2...latest` | `~4.2.0` ([ref](https://github.com/socketio/socket.io/commit/9890b036cf942f6b6ad2afeb6a8361c32cd5d528)) | `npm audit fix` should be sufficient | | `4.1.3...4.5.1` | `~4.1.1` ([ref](https://github.com/socketio/socket.io/commit/7c44893d7878cd5bba1eff43150c3e664f88fb57)) | Please upgrade to `socket.io@4.6.x` | | `3.0.5...4.1.2` | `~4.0.3` ([ref](https://github.com/socketio/socket.io/commit/752dfe3b1e5fecda53dae899b4a39e6fed5a1a17)) | Please upgrade to `socket.io@4.6.x` | | `3.0.0...3.0.4` | `~4.0.1` ([ref](https://github.com/socketio/socket.io/commit/1af3267e3f5f7884214cf2ca4d5282d620092fb0)) | Please upgrade to `socket.io@4.6.x` | | `2.3.0...2.5.0` | `~3.4.0` ([ref](https://github.com/socketio/socket.io/commit/cf39362014f5ff13a17168b74772c43920d6e4fd)) | `npm audit fix` should be sufficient | ### Workarounds There is no known workaround except upgrading to a safe version. ### For more information If you have any questions or comments about this advisory: - Open a discussion [here](https://github.com/socketio/socket.io/discussions) Thanks to [@rafax00](https://github.com/rafax00) for the responsible disclosure.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Watson Knowledge Catalog on-prem | <=4.x | |
| npm/socket.io-parser | <3.3.4 | 3.3.4 |
| npm/socket.io-parser | >=4.0.4<4.2.3 | 4.2.3 |
| npm/socket.io-parser | >=3.4.0<3.4.3 | 3.4.3 |
| Socket Socket.io-parser Node.js | >=3.4.0<3.4.3 | |
| Socket Socket.io-parser Node.js | >=4.0.4<4.2.3 | |
| >=3.4.0<3.4.3 | ||
| >=4.0.4<4.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
- https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
- https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
- https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9
- https://exchange.xforce.ibmcloud.com/vulnerabilities/256442
- https://www.ibm.com/support/pages/node/7009747 (Advisory)
- https://github.com/socketio/socket.io-parser/commit/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9
- https://nvd.nist.gov/vuln/detail/CVE-2023-32695
- https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4
- https://github.com/advisories/GHSA-cqmj-92xf-r6r9 (Advisory)
Frequently Asked Questions
What is CVE-2023-32695?
CVE-2023-32695 refers to a vulnerability in the Socket.IO socket.io-parser library that allows for a denial of service attack by triggering an uncaught exception on the server.
What is the severity of CVE-2023-32695?
CVE-2023-32695 has a severity rating of 7.5 (High).
Which software versions are affected by CVE-2023-32695?
Versions between 3.4.0 and 3.4.3 of Socket.io-parser and versions between 4.0.4 and 4.2.3 of Socket.io-parser are affected. Additionally, IBM Watson Knowledge Catalog on-prem 4.x is also affected.
How can I fix CVE-2023-32695?
To fix CVE-2023-32695, update Socket.io-parser to version 4.2.3, which contains a patch for this vulnerability.
Where can I find more information about CVE-2023-32695?
You can find more information about CVE-2023-32695 on the official Socket.IO socket.io-parser GitHub repository and the associated commits.
- collector/nvd-latest
- agent/type
- agent/remedy
- agent/weakness
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-cqmj-92xf-r6r9
- alias/CVE-2023-32695
- collector/ibm-support
- source/IBM
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/event
- agent/tags
- collector/github-advisory
- vendor/socket
- canonical/socket socket.io-parser node.js
- version/socket socket.io-parser node.js/3.4.0
- version/socket socket.io-parser node.js/4.0.4
- package-manager/npm
- vendor/ibm
- canonical/ibm watson knowledge catalog on-prem
- version/ibm watson knowledge catalog on-prem/4.x