CORS misconfiguration in socket.io

Description

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Recommendation

Update the socket.io package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.4.0
• Patched version(s): 2.4.0

References

• GHSA-fxwf-4rqh-v8g3
• snyk.io
• CVE-2020-28481
• CWE-346
• CWE-453
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Path Traversal in socket.io-file - CVE-2020-15779
• Resource exhaustion in socket.io-parser - CVE-2020-36049
• File restriction bypass in socket.io-file - CVE-2020-24807
• socket.io has an unhandled 'error' event - CVE-2024-38355

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

socket.io