PT-2020-19716 · Sockjs · Sockjs

Andrew Snow · Published 2020-07-09 · Updated 2022-07-12 · CVE-2020-7693

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions sockjs versions prior to 0.3.20

Description The issue arises from incorrect handling of the Upgrade header with the value websocket, leading to the crashing of containers hosting sockjs apps.

Recommendations For versions prior to 0.3.20, update to version 0.3.20 or later to resolve the issue.

Exploit

Fix

Improper Handling of Exceptional Conditions

RCE

Weakness Enumeration

CWE-755

CWE-20

Related Identifiers

CVE-2020-7693

GHSA-C9G6-9335-X697

SNYK-JAVA-ORGWEBJARSNPM-575448

SNYK-JS-SOCKJS-575261

Affected Products

Sockjs

References · 10

• 🔥 https://github.com/sockjs/sockjs-node/issues/252 · Exploit
• 🔥 https://github.com/andsnw/sockjs-dos-py · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-575448 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-SOCKJS-575261 · Exploit
• https://github.com/sockjs/sockjs-node/pull/265 · Patch
• https://github.com/sockjs/sockjs-node/commit/dd7e642cd69ee74385825816d30642c43e051d16 · Patch
• https://osv.dev/vulnerability/GHSA-c9g6-9335-x697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7693 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7693 · Vendor Advisory
• https://npmjs.com/package/sockjs · Note