PT-2022-17577 · Unknown · Io.Socket:Socket.Io-Client

Andrei Nikonov · Published 2022-08-02 · Updated 2022-08-10 · CVE-2022-25867

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions io.socket:socket.io-client versions prior to 2.0.1

Description The issue is related to a NULL Pointer Dereference that occurs when parsing a packet with an invalid payload format. This can happen in the io.socket:socket.io-client package.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider implementing input validation to ensure that only packets with valid payload formats are processed. Restrict access to the packet parsing functionality to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2022-25867

GHSA-85XX-XHJM-RHRW

Affected Products

Io.Socket:Socket.Io-Client

References · 11

• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-IOSOCKET-2949738 · Exploit
• https://github.com/socketio/socket.io-client-java/commit/8664499b6f31154f49783531f778dac5387b766b · Patch
• https://github.com/socketio/socket.io-client-java/commit/e8ffe9d1383736f6a21090ab959a2f4fa5a41284 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25867 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25867 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-85xx-xhjm-rhrw · Vendor Advisory
• https://github.com/socketio/socket.io-client-java/issues/508%23issuecomment-1179817361 · Note
• https://github.com/socketio/socket.io-client-java/releases/tag/socket.io-client-2.0.1 · Note
• https://github.com/socketio/socket.io-client-java · Note
• https://t.me/cibsecurity/47406 · Telegram Post
• https://t.me/cvenotify/34137 · Telegram Post