CVE-2021-32640 : What You Need to Know

A WebSocket library for Node.js, ws, is affected by a Regular expression Denial of Service (ReDoS) vulnerability due to a crafted

Sec-Websocket-Protocol

header. Attackers can slow down the server significantly by exploiting this issue. The vulnerability has been fixed in version 7.4.6. Mitigation involves limiting the request header size.

Understanding CVE-2021-32640

This section provides insights into the impact, technical details, and mitigation strategies related to CVE-2021-32640.

What is CVE-2021-32640?

CVE-2021-32640 is a ReDoS vulnerability in the

Sec-Websocket-Protocol

header of the ws WebSocket library in versions prior to 7.4.6. This vulnerability allows attackers to slow down a ws server.

The Impact of CVE-2021-32640

The vulnerability has a CVSS base score of 5.3, indicating a medium severity level. It has low attack complexity and impact on availability, with no impact on confidentiality or integrity. However, immediate action is necessary to prevent potential exploitation.

Technical Details of CVE-2021-32640

Let's delve into the specific technical aspects of the CVE-2021-32640 vulnerability.

Vulnerability Description

The vulnerability arises from a specially crafted value in the

Sec-Websocket-Protocol

header, leading to a ReDoS attack that can slow down the ws server.

Affected Systems and Versions

Systems using ws WebSocket library versions from 5.0.0 to 7.4.5 are vulnerable to this ReDoS issue.

Exploitation Mechanism

Attackers can exploit the vulnerability by sending a malicious

Sec-Websocket-Protocol

header, causing a significant slowdown in server responsiveness.

Mitigation and Prevention

Here's how you can address and mitigate the CVE-2021-32640 vulnerability effectively.

Immediate Steps to Take

Upgrade to version 7.4.6 of the ws library to patch the vulnerability. Additionally, limit the maximum allowed length of request headers using the provided options.

Long-Term Security Practices

Regularly update the WebSocket library and monitor for any security advisories or patches to stay protected from emerging threats.

Patching and Updates

Stay informed about the latest security updates and promptly apply patches released by the ws library maintainers to ensure ongoing protection against vulnerabilities.