PT-2017-7918 · Ecstatic · Ecstatic

Publicado 2017-12-14 · Atualizado 2021-03-30 · CVE-2016-10703

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ecstatic versions prior to 2.0.0

Description A denial of service issue exists due to a regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js. This allows a remote attacker to overload and crash a server by passing a maliciously crafted string, specifically a payload with a large number of null bytes (%00), which can cause the server to run out of memory. The impact of the payload varies by size, with larger payloads causing increased lag or even server crashes.

Recommendations Update to version 2.0.0 or later. As a temporary workaround, consider restricting access to the ecstatic middleware to minimize the risk of exploitation. Avoid using payloads with a large number of null bytes (%00) in the affected API endpoint until the issue is resolved.

Exploit

Correção

Resource Exhaustion

RCE

Enumeração de Fraquezas

CWE-400

CWE-20

Identificadores relacionados

CVE-2016-10703

GHSA-PM9P-9926-W68M

Produtos afetados

Ecstatic

Referências · 10

• 🔥 https://checkmarx.com/advisories/denial-of-service-dos-vulnerability-in-ecstatic-npm-package · Exploit
• https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01#diff-b2b5a88fb51675f1aa1065c093dce1ee · Nota
• https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01 · Correção
• https://github.com/jfhbrook/node-ecstatic · Nota
• https://osv.dev/vulnerability/CVE-2016-10703 · Aviso do Fabricante
• https://github.com/advisories/GHSA-pm9p-9926-w68m · Nota
• https://advisory.checkmarx.net/advisory/CX-2016-4450 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10703 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-pm9p-9926-w68m · Aviso do Fabricante
• https://npmjs.com/advisories/553 · Nota