Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Socket.io | Socket.io-Parser | 4.x – < 4.2.1 | 4.2.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | socket.io-parser | >= 4.0.0, < 4.0.5 | 4.0.5 | GHSA-qm95-pgcg-qqfq |
| npm | socket.io-parser | >= 4.1.0, < 4.2.1 | 4.2.1 | GHSA-qm95-pgcg-qqfq |
| npm | socket.io-parser | < 3.3.3 | 3.3.3 | GHSA-qm95-pgcg-qqfq |
| npm | socket.io-parser | >= 3.4.0, < 3.4.2 | 3.4.2 | GHSA-qm95-pgcg-qqfq |
References
- https://csirt.divd.nl/CVE-2022-2421 third-party-advisory
- https://csirt.divd.nl/DIVD-2022-00045 third-party-advisory