CVE-2023-26104
📋 TL;DR
All versions of the lite-web-server package are vulnerable to Denial of Service (DoS) when attackers send HTTP requests containing control characters that the decodeURI() function cannot parse. This vulnerability allows attackers to crash the web server, making it unavailable to legitimate users. Anyone using the lite-web-server package is affected.
💻 Affected Systems
- lite-web-server
📦 What is this software?
Lite Web Server by Lite Web Server Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability requiring manual restart of the web server process, potentially causing extended downtime for applications relying on this server.
Likely Case
Temporary service disruption where the web server crashes and needs to be restarted, causing brief outages for users.
If Mitigated
Minimal impact with proper monitoring and automated restart mechanisms in place to quickly recover from crashes.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests with malformed URIs containing control characters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://security.snyk.io/vuln/SNYK-JS-LITEWEBSERVER-3153703
Restart Required: Yes
Instructions:
1. Consider migrating to an alternative web server package. 2. If continuing with lite-web-server, implement input validation to filter control characters before decodeURI() processing.
🔧 Temporary Workarounds
Input Validation Filter
allAdd middleware to filter out control characters from incoming HTTP requests before they reach the vulnerable decodeURI() function.
// Add this middleware before request processing:
app.use((req, res, next) => {
const cleanedUrl = req.url.replace(/[\x00-\x1F\x7F]/g, '');
req.url = cleanedUrl;
next();
});
🧯 If You Can't Patch
- Implement rate limiting and request filtering at the network perimeter (firewall/WAF) to block requests with control characters.
- Deploy monitoring and automated restart mechanisms to quickly recover from crashes.
🔍 How to Verify
Check if Vulnerable:
Check if your application uses lite-web-server by examining package.json or running 'npm list lite-web-server'.Check Version:
npm list lite-web-serverVerify Fix Applied:
Test with crafted requests containing control characters (e.g., %00, %0D) to verify the server no longer crashes.📡 Detection & Monitoring
Log Indicators:
- Web server process crashes or restarts
- Error logs showing decodeURI() failures or malformed URI errors
Network Indicators:
- HTTP requests containing control characters in URLs (e.g., %00, %0D, %1B)
SIEM Query:
source="web_server_logs" AND (error="decodeURI" OR error="malformed" OR process="restart")🔗 References
- https://gist.github.com/lirantal/637520812da06fffb91dd86d02ff6bde
- https://github.com/chasyumen/lite-web-server/blob/main/src/WebServer.js%23L274
- https://security.snyk.io/vuln/SNYK-JS-LITEWEBSERVER-3153703
- https://gist.github.com/lirantal/637520812da06fffb91dd86d02ff6bde
- https://github.com/chasyumen/lite-web-server/blob/main/src/WebServer.js%23L274
- https://security.snyk.io/vuln/SNYK-JS-LITEWEBSERVER-3153703
