Executive Summary

This vulnerability exists in the ESP-IDF framework's esp_http_server component, specifically in the WebSocket subprotocol-negotiation path. It is caused by a NULL-pointer dereference when parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake. The code attempts to tokenize the header value without checking if the tokenization result is NULL, which can happen if the header is malformed. This leads to the server crashing before any application-level authentication occurs.

The issue affects multiple versions of ESP-IDF (5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0) and has been fixed in later versions by adding proper NULL checks and length validations in the subprotocol parsing function to prevent dereferencing NULL pointers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited remotely by an attacker sending a specially crafted Sec-WebSocket-Protocol header during the WebSocket handshake. Because the server crashes upon processing this malformed header, the impact is a denial of service (DoS).

The attacker does not need any privileges or user interaction to exploit this vulnerability, and it can cause the server to become unavailable, potentially disrupting services that rely on the WebSocket server.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs due to a NULL-pointer dereference in the WebSocket subprotocol-negotiation path when parsing a malformed Sec-WebSocket-Protocol request header. Detection involves monitoring for crashes or denial of service symptoms in the esp_http_server component when handling WebSocket handshake requests.

Since the issue is triggered by malformed Sec-WebSocket-Protocol headers, you can detect attempts by capturing and inspecting WebSocket handshake requests on your network for unusual or malformed Sec-WebSocket-Protocol headers.

Suggested commands to detect potential exploitation attempts include using network packet capture tools like tcpdump or Wireshark to filter WebSocket handshake requests and analyze the Sec-WebSocket-Protocol headers.

• tcpdump -i <interface> -A -s 0 'tcp port 80 or tcp port 443' | grep 'Sec-WebSocket-Protocol'
• Use Wireshark to filter HTTP requests with the display filter: http.header.sec_websocket_protocol

Additionally, monitoring server logs for crashes or unexpected restarts of the esp_http_server component can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade the ESP-IDF framework to a patched version where this vulnerability is fixed. The patched versions are 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1 or later.

If upgrading immediately is not possible, temporary mitigations include:

• Avoid enabling WebSocket subprotocol negotiation in your application.
• Enable mutual TLS authentication to restrict access and reduce the risk of exploitation.

These steps help prevent remote attackers from sending malformed Sec-WebSocket-Protocol headers that could crash the server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service by crashing the server when processing malformed WebSocket subprotocol headers, but it does not lead to information disclosure or data modification.

Since the vulnerability does not expose or alter sensitive data, it does not directly impact compliance with data protection regulations such as GDPR or HIPAA.

However, denial of service incidents can affect availability requirements under these standards, so organizations using affected versions should apply patches or mitigations to maintain compliance.

Useful 0 Not Useful 0