Memory Exhaustion in ws WebSocket Library

Executive Summary

This vulnerability is a memory exhaustion issue in the WebSocket library (ws) before version 8.21.1. It occurs in lib/receiver.js where the fragment guard only activates when the fragment count reaches maxFragments. Attackers can send incomplete fragmented WebSocket messages by starting with a text frame (FIN=0) followed by continuation frames without completing the sequence. Each fragment is stored as a separate Buffer object, consuming significant memory and causing heap exhaustion leading to denial of service.

Useful 0 Not Useful 0

Detection Guidance

Monitor WebSocket connections for incomplete fragmented messages. Use tools like Wireshark to inspect WebSocket frames for FIN=0 and continuation frames without completion. Check server logs for memory usage spikes or OOM errors in Node.js processes handling WebSocket connections.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to crash your WebSocket server by sending specially crafted fragmented messages that consume excessive memory. A single attacker could exhaust server resources, causing the application to slow down or become unresponsive. Multiple attackers could amplify the impact, potentially leading to system-wide outages or crashes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with GDPR and HIPAA by causing service disruptions due to denial of service. GDPR requires ensuring the availability of processing systems, while HIPAA mandates safeguards to protect data integrity and availability. A DoS attack exploiting this vulnerability could violate these requirements, potentially leading to regulatory penalties or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade the ws library to version 8.21.1 or later to apply the security fix.
• Reduce default values of maxFragments and maxBufferedChunks in your WebSocket server configuration to limit memory usage.
• Implement per-connection and process-wide byte caps to prevent excessive memory consumption from fragmented messages.
• Monitor server memory usage and set up alerts for abnormal spikes that may indicate an ongoing attack.

Useful 0 Not Useful 0