CVE-2020-36049
📋 TL;DR
This vulnerability in socket.io-parser allows attackers to cause denial of service through memory exhaustion by sending specially crafted large packets. The parser uses inefficient string concatenation that consumes excessive memory when processing large payloads. Any application using vulnerable versions of socket.io-parser for WebSocket communication is affected.
💻 Affected Systems
- socket.io-parser
- socket.io
- socket.io-client
- engine.io
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to memory exhaustion, potentially requiring server restart and causing extended downtime.
Likely Case
Degraded performance and intermittent service disruptions as memory consumption spikes during attacks.
If Mitigated
Minimal impact with proper monitoring and resource limits in place, though some performance degradation may still occur.
🎯 Exploit Status
Public proof-of-concept tools exist (kill-engine-io), making exploitation trivial for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.1
Vendor Advisory: https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55
Restart Required: Yes
Instructions:
1. Update socket.io-parser to version 3.4.1 or later. 2. Update socket.io and related dependencies. 3. Restart the application/service. 4. Test WebSocket functionality.
🔧 Temporary Workarounds
Rate Limiting
allImplement rate limiting on WebSocket connections to restrict packet frequency and size.
Memory Limits
allConfigure application memory limits and automatic restart policies to mitigate complete exhaustion.
🧯 If You Can't Patch
- Implement network-level filtering to block unusually large WebSocket packets.
- Deploy Web Application Firewall (WAF) with WebSocket protection rules.
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/socket.io-parser/package.json for version number.Check Version:
npm list socket.io-parserVerify Fix Applied:
Confirm socket.io-parser version is 3.4.1 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual memory consumption spikes
- Process crashes/restarts
- High packet size warnings
Network Indicators:
- Large WebSocket packets (>1MB)
- High frequency of WebSocket connections
SIEM Query:
source="application.logs" AND ("memory spike" OR "out of memory") AND process="node"🔗 References
- https://blog.caller.xyz/socketio-engineio-dos/
- https://github.com/bcaller/kill-engine-io
- https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55
- https://blog.caller.xyz/socketio-engineio-dos/
- https://github.com/bcaller/kill-engine-io
- https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55
