Denial of Service (DoS)

Affecting hapi package, versions <11.1.3

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

Sending a purposefully crafted invalid date in the If-Modified-Since or Last-Modified header will cause the Hapi server to err but keep the socket open (the socket will time out after 2 minutes by default). This allows an attacker to quickly exhaust the sockets on the server, making it unavailable (a Denial of Service attack).

The vulnerability is caused by the combination of two bugs. First, the underlying V8 engine throws an exception when processing the specially crafted date, instead of stating the date is invalid as it should. Second, the Hapi server does not handle the exception well, leading to the socket remaining open.

Upgrading Hapi will address the second issue and thus fix the vulnerability.

References

CVSS Score

7.5
high severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    None
  • Integrity
    None
  • Availability
    High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Credit
Adam Baldwin
CVE
CVE-2015-9241
CWE
CWE-400
Snyk ID
npm:hapi:20151223
Disclosed
23 Dec, 2015
Published
24 Dec, 2015