CVE-2017-16025 (published 2018-06-04T19:29Z)

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/hapijs/nes
commit_details: repo_url: https://github.com/hapijs/nes
author: Eran Hammer
author_date: 2017-03-20 11:30:29-07:00
msg: Fix invalid cookie header. Closes #171
repository: repo_url: https://github.com/hapijs/nes
repo_name: hapijs/nes
description: WebSocket adapter plugin for hapi routes
repo_language: JavaScript
owner: hapijs
file_changes: filename: socket.js
change_type: ModificationType.MODIFY
diff: @@ -537,7 +537,12 @@ internals.Socket.prototype._authenticate = function () {
         return;
     }
 
-    this._listener._connection.states.parse(cookies, (ignoreErr, state, failed) => {
+    this._listener._connection.states.parse(cookies, (err, state, failed) => {
+
+        if (err) {
+            this.auth._error = Boom.unauthorized('Invalid nes authentication cookie');
+            return;
+        }
 
         const auth = state[config.cookie];
         if (auth) {

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 {
   "name": "nes",
   "description": "WebSocket adapter plugin for hapi routes",
-  "version": "6.4.0",
+  "version": "6.4.1",
   "repository": "git://github.com/hapijs/nes",
   "main": "lib/index.js",
   "browser": "dist/client.js",
@@ -31,7 +31,7 @@
     "babel-preset-es2015": "^6.1.2",
     "code": "4.x.x",
     "hapi": "16.x.x",
-    "lab": "11.x.x"
+    "lab": "13.x.x"
   },
   "babel": {
     "presets": ["es2015"]

programming_language: JavaScript
filename: auth.js
change_type: ModificationType.MODIFY
diff: @@ -392,6 +392,41 @@ describe('authentication', () => {
             });
         });
 
+        it('errors on invalid cookie', (done) => {
+
+            const server = new Hapi.Server();
+            server.connection();
+
+            server.register({ register: Nes, options: { auth: { type: 'cookie' } } }, (err) => {
+
+                expect(err).to.not.exist();
+
+                server.auth.scheme('custom', internals.implementation);
+                server.auth.strategy('default', 'custom', true);
+
+                server.route({
+                    method: 'GET',
+                    path: '/',
+                    handler: function (request, reply) {
+
+                        return reply('hello');
+                    }
+                });
+
+                server.start((err) => {
+
+                    expect(err).to.not.exist();
+                    const client = new Nes.Client('http://localhost:' + server.info.port, { ws: { headers: { cookie: '"' } } });
+                    client.connect((err) => {
+
+                        expect(err).to.be.an.error('Invalid nes authentication cookie');
+                        client.disconnect();
+                        server.stop(done);
+                    });
+                });
+            });
+        });
+
         it('overrides cookie path', (done) => {
 
             const server = new Hapi.Server();

programming_language: TypeScript