Summary
A Denial of Service (DoS) vulnerability in the file ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
Product
Ecstatic before 2.0.0
Impact
If exploited, a threat actor will be to crash an application using that uses a vulnerable version of the ecstatic npm package, causing a Denial of Service and thus compromising the availability of the application.
Steps to reproduce
The vulnerable function uses a loop to replace null bytes in the URL string, as can be seen in the following snippet of the library:
// Strip any null bytes from the url
while(req.url.indexOf('%00') !== -1 ) {
req.url = req.url.replace(/%00/g,'');
}Since the application also does not validate the url length at any point, the flow of the execution will continue until it does not find any more null bytes.
In order to exploit this issue, a threat actor may perform the following request, with arbitrary null bytes appended:
https://localhost:8080//%00%00%00%00%00%00...Expected result
A payload of 22kB caused a lag of 1 second,
A payload of 35kB caused a lag of 3 seconds,
A payload of 86kB caused the server to crash due to memory shortage.
Remediation
Update ecstatic dependency to 2.0.0 and above
Credit
This issue was discovered and reported by Checkmarx Security Researcher @erezyalon (Erez Yalon).
