PT-2018-6061 · Socket.Io · Socket.Io

Published 2018-06-04 · Updated 2018-11-07 · CVE-2017-16031

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: socket.io versions 0.9.6 and earlier

Description: The issue concerns the predictability of socket IDs in socket.io, which are generated using Math.random(). This predictability allows an attacker to guess the socket ID, potentially gaining unauthorized access to socket.io servers and obtaining sensitive information.

Recommendations: Update to v0.9.7 or later.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2017-16031

GHSA-QV2V-M59F-V5FW

Affected Products

Socket.Io

References · 10

• https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8 · Patch
• https://osv.dev/vulnerability/CVE-2017-16031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16031 · Security Note
• https://osv.dev/vulnerability/GHSA-qv2v-m59f-v5fw · Vendor Advisory
• https://github.com/socketio/socket.io · Note
• https://github.com/socketio/socket.io/issues/856 · Note
• https://github.com/socketio/socket.io/pull/857 · Note
• https://nodesecurity.io/advisories/321 · Note
• https://npmjs.com/advisories/321 · Note
• https://github.com/advisories/GHSA-qv2v-m59f-v5fw · Note