Null Dereference in Let's Chat Server

Executive Summary

This is a null dereference vulnerability in Let's Chat versions 0.4.0 through 0.4.8. Authenticated attackers can crash the server by sending a GET /messages request with a valid 24-character hex string room parameter that doesn't exist in the database. This triggers an uncaught TypeError in an asynchronous Mongoose callback, terminating the Node.js process. The flaw is reachable through multiple code paths including socket.io.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in the Let's Chat Node.js server when sending GET /messages requests with a 24-character hex string room parameter that does not exist in the database. Check server logs for uncaught TypeError exceptions or process termination events.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers to crash the server repeatedly, causing a denial of service. Even with process supervision, repeated requests can keep the server down. Attackers only need a valid user account and network access to exploit this flaw. Default installations allow account creation, making exploitation straightforward.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the server, which could disrupt availability of services. For GDPR, this may impact data access or processing if the crash affects user data handling. For HIPAA, it could interrupt critical healthcare operations if the server supports protected health information systems.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version if available. If no patch exists, implement input validation for the room parameter in the /messages endpoint and add error handling for asynchronous Mongoose callbacks. Disable account creation if enabled by default and restrict access to authenticated users only.

Useful 0 Not Useful 0