CVE-2020-36406
📋 TL;DR
This CVE describes a stack-based buffer overflow vulnerability in uWebSockets versions 18.11.0 and 18.12.0. The vulnerability occurs in the TopicTree::trimTree function when handling large numbers of accumulated topics, potentially allowing attackers to execute arbitrary code or crash the application. Applications using these vulnerable uWebSockets versions are affected.
💻 Affected Systems
- uWebSockets
📦 What is this software?
Uwebsockets by Uwebsockets Project
Uwebsockets by Uwebsockets Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption.
Likely Case
Application crash (denial of service) due to buffer overflow triggering segmentation faults.
If Mitigated
No impact if proper topic management prevents accumulation of large numbers of triggered topics.
🎯 Exploit Status
Exploit requires triggering the unsubscribeAll function with accumulated topics. Public PoC exists in OSS-Fuzz reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 03fca626a95130ab80f86adada54b29d27242759 and later versions
Vendor Advisory: https://github.com/uNetworking/uWebSockets/commit/03fca626a95130ab80f86adada54b29d27242759
Restart Required: Yes
Instructions:
1. Update uWebSockets to version after commit 03fca626a95130ab80f86adada54b29d27242759. 2. Rebuild and redeploy applications using uWebSockets. 3. Restart affected services.
🔧 Temporary Workarounds
Limit Topic Accumulation
allImplement application-level controls to prevent accumulation of large numbers of triggered topics
// Application code modification required - implement topic cleanup logic
🧯 If You Can't Patch
- Implement strict input validation and rate limiting on WebSocket connections
- Deploy network segmentation and firewall rules to limit access to vulnerable services
🔍 How to Verify
Check if Vulnerable:
Check uWebSockets version in package.json or build configuration for versions 18.11.0 or 18.12.0Check Version:
grep -r "uwebsockets" package.json || check build configuration filesVerify Fix Applied:
Verify uWebSockets version is after commit 03fca626a95130ab80f86adada54b29d27242759📡 Detection & Monitoring
Log Indicators:
- Segmentation fault logs
- Abnormal process termination
- High memory usage spikes
Network Indicators:
- Unusual WebSocket subscription patterns
- Rapid topic creation/unsubscription requests
SIEM Query:
process.name="node" AND (event.action="segmentation_fault" OR event.action="crash")🔗 References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25381
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/uwebsockets/OSV-2020-1695.yaml
- https://github.com/uNetworking/uWebSockets/commit/03fca626a95130ab80f86adada54b29d27242759
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25381
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/uwebsockets/OSV-2020-1695.yaml
- https://github.com/uNetworking/uWebSockets/commit/03fca626a95130ab80f86adada54b29d27242759
