PT-2022-4447 · Unknown · Node-Opcua

Sharon Brizinov + 2 · Published 2022-08-24 · Updated 2022-08-26 · CVE-2022-24375

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions node-opcua versions prior to 2.74.0

Description The issue is related to a Denial of Service (DoS) condition that can be triggered by bypassing limitations for excessive memory consumption. This can be achieved by sending multiple CloseSession requests with the deleteSubscription parameter set to False. The vulnerability is associated with incorrect cleanup or release of resources, which can be exploited by a remote attacker to cause a service disruption.

Recommendations For versions prior to 2.74.0, update to version 2.74.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the CloseSession request or setting the deleteSubscription parameter to True to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2022-05312

CVE-2022-24375

GHSA-VH4F-FGPP-X8X2

Affected Products

Node-Opcua

References · 10

• https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2f · Patch
• https://github.com/node-opcua/node-opcua/commit/3fd46ec156e7718a506be41f3916310b6bdd0407 · Patch
• https://github.com/node-opcua/node-opcua/pull/1182 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24375 · Security Note
• https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988725 · Patch
• https://bdu.fstec.ru/vul/2022-05312 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24375 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vh4f-fgpp-x8x2 · Vendor Advisory
• https://github.com/node-opcua/node-opcua · Note
• https://t.me/cibsecurity/48629 · Telegram Post