Vulnerabilities > CVE-2022-41940 - Uncaught Exception vulnerability in Socket Engine.Io

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

socket

CWE-248

NVD

Published: 2022-11-22

Updated: 2022-11-26

Summary

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

Vulnerable Configurations

Part	Description	Count
Application	Socket Socket Engine.Io 0.1.0 Socket Engine.Io 0.1.1 Socket Engine.Io 0.1.2 Socket Engine.Io 0.2.0 Socket Engine.Io 0.2.1 Socket Engine.Io 0.2.2 Socket Engine.Io 0.3.0 Socket Engine.Io 0.3.1 Socket Engine.Io 0.3.2 Socket Engine.Io 0.3.3 Socket Engine.Io 0.3.4 Socket Engine.Io 0.3.5 Socket Engine.Io 0.3.7 Socket Engine.Io 0.3.8 Socket Engine.Io 0.3.9 Socket Engine.Io 0.3.10 Socket Engine.Io 0.4.1 Socket Engine.Io 0.4.2 Socket Engine.Io 0.4.3 Socket Engine.Io 0.5.0 Socket Engine.Io 0.6.0 Socket Engine.Io 0.6.1 Socket Engine.Io 0.6.2 Socket Engine.Io 0.6.3 Socket Engine.Io 0.7.0 Socket Engine.Io 0.7.1 Socket Engine.Io 0.7.2 Socket Engine.Io 0.7.3 Socket Engine.Io 0.7.4 Socket Engine.Io 0.7.5 Socket Engine.Io 0.7.6 Socket Engine.Io 0.7.7 Socket Engine.Io 0.7.8 Socket Engine.Io 0.7.9 Socket Engine.Io 0.7.10 Socket Engine.Io 0.7.11 Socket Engine.Io 0.7.12 Socket Engine.Io 0.7.13 Socket Engine.Io 0.7.14 Socket Engine.Io 0.8.0 Socket Engine.Io 0.8.1 Socket Engine.Io 0.8.2 Socket Engine.Io 0.9.0 Socket Engine.Io 1.0.0 Socket Engine.Io 1.0.1 Socket Engine.Io 1.0.2 Socket Engine.Io 1.0.3 Socket Engine.Io 1.0.4 Socket Engine.Io 1.0.5 Socket Engine.Io 1.1.0 Socket Engine.Io 1.1.1 Socket Engine.Io 1.2.0 Socket Engine.Io 1.2.1 Socket Engine.Io 1.2.2 Socket Engine.Io 1.3.0 Socket Engine.Io 1.3.1 Socket Engine.Io 1.4.0 Socket Engine.Io 1.4.1 Socket Engine.Io 1.4.2 Socket Engine.Io 1.4.3 Socket Engine.Io 1.5.0 Socket Engine.Io 1.5.1 Socket Engine.Io 1.5.2 Socket Engine.Io 1.5.3 Socket Engine.Io 1.6.0 Socket Engine.Io 1.6.1 Socket Engine.Io 1.6.2 Socket Engine.Io 1.6.3 Socket Engine.Io 1.6.4 Socket Engine.Io 1.6.5 Socket Engine.Io 1.6.6 Socket Engine.Io 1.6.7 Socket Engine.Io 1.6.8 Socket Engine.Io 1.6.10 Socket Engine.Io 1.6.11 Socket Engine.Io 1.7.0 Socket Engine.Io 1.7.1 Socket Engine.Io 1.7.2 Socket Engine.Io 1.8.0 Socket Engine.Io 1.8.1 Socket Engine.Io 1.8.2 Socket Engine.Io 1.8.3 Socket Engine.Io 1.8.4 Socket Engine.Io 1.8.5 Socket Engine.Io 2.0.0 Socket Engine.Io 2.0.1 Socket Engine.Io 2.0.2 Socket Engine.Io 2.1.0 Socket Engine.Io 2.1.1 Socket Engine.Io 3.0.0 Socket Engine.Io 3.1.0 Socket Engine.Io 3.1.1 Socket Engine.Io 3.1.2 Socket Engine.Io 3.1.3 Socket Engine.Io 3.1.4 Socket Engine.Io 3.1.5 Socket Engine.Io 3.2.0 Socket Engine.Io 3.2.1 Socket Engine.Io 3.3.0 Socket Engine.Io 3.3.1 Socket Engine.Io 3.3.2 Socket Engine.Io 3.4.0 Socket Engine.Io 3.4.1 Socket Engine.Io 3.4.2 Socket Engine.Io 3.5.0 Socket Engine.Io 3.6.0 Socket Engine.Io 4.0.0 Socket Engine.Io 4.0.1 Socket Engine.Io 4.0.2 Socket Engine.Io 4.0.3 Socket Engine.Io 4.0.4 Socket Engine.Io 4.0.5 Socket Engine.Io 4.0.6 Socket Engine.Io 4.1.0 Socket Engine.Io 4.1.1 Socket Engine.Io 4.1.2 Socket Engine.Io 5.0.0 Socket Engine.Io 5.1.0 Socket Engine.Io 5.1.1 Socket Engine.Io 5.2.0 Socket Engine.Io 5.2.1 Socket Engine.Io 6.0.0 Socket Engine.Io 6.0.1 Socket Engine.Io 6.1.0 Socket Engine.Io 6.1.1 Socket Engine.Io 6.1.2 Socket Engine.Io 6.1.3 Socket Engine.Io 6.2.0	130

Common Weakness Enumeration (CWE)

CWE-248 - Uncaught Exception

Common Attack Pattern Enumeration and Classification (CAPEC)

Probe Application Error Reporting
An Attacker, aware of an application's location (and possibly authorized to use the application) can probe the application's structure and evaluate its robustness by probing its error conditions (not unlike one would during a 'fuzz' test, but more purposefully here) in order to support attacks such as blind SQL injection, or for the more general task of mapping the application to mount another subsequent attack.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References