PT-2017-7918 · Ecstatic · Ecstatic

Published 2017-12-14 · Updated 2021-03-30 · CVE-2016-10703

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ecstatic versions prior to 2.0.0

Description A denial of service issue exists due to a regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js. This allows a remote attacker to overload and crash a server by passing a maliciously crafted string, specifically a payload with a large number of null bytes (%00), which can cause the server to run out of memory. The impact of the payload varies by size, with larger payloads causing increased lag or even server crashes.

Recommendations Update to version 2.0.0 or later. As a temporary workaround, consider restricting access to the ecstatic middleware to minimize the risk of exploitation. Avoid using payloads with a large number of null bytes (%00) in the affected API endpoint until the issue is resolved.

Exploit

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2016-10703

GHSA-PM9P-9926-W68M

Affected Products

Ecstatic

References · 10

• 🔥 https://checkmarx.com/advisories/denial-of-service-dos-vulnerability-in-ecstatic-npm-package · Exploit
• https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01 · Patch
• https://osv.dev/vulnerability/CVE-2016-10703 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10703 · Security Note
• https://osv.dev/vulnerability/GHSA-pm9p-9926-w68m · Vendor Advisory
• https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01#diff-b2b5a88fb51675f1aa1065c093dce1ee · Note
• https://github.com/jfhbrook/node-ecstatic · Note
• https://github.com/advisories/GHSA-pm9p-9926-w68m · Note
• https://advisory.checkmarx.net/advisory/CX-2016-4450 · Note
• https://npmjs.com/advisories/553 · Note