CVE-2022-36127
📋 TL;DR
A denial-of-service vulnerability in Apache SkyWalking NodeJS Agent versions before 0.5.1 causes NodeJS services with this agent installed to become unavailable when the OAP (Observability Analysis Platform) is unhealthy and the agent cannot establish a connection. This affects any NodeJS service using vulnerable SkyWalking agent versions for application performance monitoring.
💻 Affected Systems
- Apache SkyWalking NodeJS Agent
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of NodeJS services when OAP connectivity fails, leading to service disruption and business impact.
Likely Case
Intermittent service unavailability during OAP maintenance, network issues, or OAP failures.
If Mitigated
Minimal impact with proper monitoring and failover mechanisms for OAP infrastructure.
🎯 Exploit Status
Exploitation requires causing OAP unavailability or network disruption between agent and OAP.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.1
Vendor Advisory: https://lists.apache.org/thread/x238wo4r5goy39dxdjcmlofp6gcdnqr3
Restart Required: Yes
Instructions:
1. Update SkyWalking NodeJS Agent to version 0.5.1 or later. 2. Restart all NodeJS services using the agent. 3. Verify agent connectivity to OAP is restored.
🔧 Temporary Workarounds
Implement OAP High Availability
allDeploy OAP in high-availability configuration to minimize connectivity failures.
Network Resilience Configuration
allConfigure network timeouts and retry logic in agent configuration.
Edit agent configuration to add: agent.config.timeout=5000
agent.config.max_retries=3
🧯 If You Can't Patch
- Monitor OAP health closely and implement rapid response procedures for OAP failures.
- Consider temporarily disabling SkyWalking agent in critical services if OAP becomes unavailable.
🔍 How to Verify
Check if Vulnerable:
Check package.json or agent configuration for SkyWalking NodeJS Agent version. If version is below 0.5.1, system is vulnerable.Check Version:
npm list @apache/skywalking-nodejs-agent or check agent configuration fileVerify Fix Applied:
Verify agent version is 0.5.1 or higher and test by temporarily disconnecting OAP to ensure services remain available.📡 Detection & Monitoring
Log Indicators:
- Agent connection errors to OAP
- Service unavailability logs coinciding with OAP connectivity issues
Network Indicators:
- Increased failed connections to OAP port
- Agent retry attempts to OAP
SIEM Query:
source="nodejs" AND ("SkyWalking" OR "OAP") AND ("connection failed" OR "unavailable")