GitHub Advisoryadvisory · npm
GHSA-qv2v-m59f-v5fw Insecure randomness in socket.io
HIGH
Official page ↗
- Aliases
- CVE-2017-16031
- Ecosystem
- npm
- Packages
- socket.io
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-330
- Reviewed
- 2020-06-16
Affected packages
• npm socket.io: < 0.9.7 → fixed in 0.9.7
Description
Affected versions of `socket.io` depend on `Math.random()` to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker may be able to guess the socket ID and gain access to socket.io servers without authorization.
Recommendation
Update to v0.9.7 or later.
Related
Alias · CVE (1)
- CVE-2017-16031 Socket.io is a realtime application framework that provides communication via websockets. vulnerability
Weakness · CWE (1)
- CWE-330 Use of Insufficiently Random Values weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-16031 advisory
- https://github.com/socketio/socket.io/issues/856 web
- https://github.com/socketio/socket.io/pull/857 web
- https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8 web
- https://github.com/advisories/GHSA-qv2v-m59f-v5fw advisory
- https://github.com/socketio/socket.io package
- https://www.npmjs.com/advisories/321 web