Description
Affected versions of socket.io depend on Math.random() to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker may be able to guess the socket ID and gain access to socket.io servers without authorization.
Recommendation
Update the socket.io package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.9.6
- Patched version(s): 0.9.7
References
Could your website be exposed too?
SmartScanner can check your website for Insecure randomness in socket.io and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CORS misconfiguration in socket.io - CVE-2020-28481
- socket.io has an unhandled 'error' event - CVE-2024-38355
- Directory Traversal in fbr-client - CVE-2017-16217
- Regular Expression Denial Of Service in uri-js - CVE-2017-16021
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023