Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2016-10536

UNKNOWN
Published 2018-05-31T20:00:00Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2016-10536. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

HackerOne

engine.io-client node module

Affected Versions:

<= 1.6.8

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Insecure Defaults Allow MITM Over TLS in engine.io-client

GHSA-4r4m-hjwj-43p8

Advisory Details

Affected versions of `engine.io-client` do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, such as undefined or null, certificate verification will be disabled. ## Recommendation Update to version 1.6.9 or later. If you are unable to upgrade, ensure all calls to socket.io to have a `rejectedUnauthorized: true` flag.

Affected Packages

npm engine.io-client
ECOSYSTEM: ≥0 <1.6.9

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2016-10536
WEB https://github.com/socketio/engine.io-client/commit/2c55b278a491bf45313ecc0825cf800e2f7ff5c1
ADVISORY https://github.com/advisories/GHSA-4r4m-hjwj-43p8
WEB https://www.cigital.com/blog/node-js-socket-io
WEB https://www.npmjs.com/advisories/99

Advisory provided by GitHub Security Advisory Database. Published: February 18, 2019, Modified: September 7, 2023

References

https://www.cigital.com/blog/node-js-socket-io/
https://github.com/socketio/engine.io-client/commit/2c55b278a491bf45313ecc0825cf800e2f7ff5c1
https://nodesecurity.io/advisories/99
Published: 2018-05-31T20:00:00Z
Last Modified: 2024-09-17T01:46:42.911Z
Copied to clipboard!