CVE-2024-38355: Socket.IO DOS Vulnerability

CVE-2024-38355 Overview

Socket.IO is an open source, real-time, bidirectional, event-based communication framework widely used in web applications for implementing WebSocket connections and real-time features. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, causing the Node.js process to crash and terminate unexpectedly. This Denial of Service vulnerability stems from improper input validation (CWE-20) that allows malicious packets to bypass error handling mechanisms.

Critical Impact

Attackers can remotely crash Node.js applications using Socket.IO by sending specially crafted packets, causing service disruption without authentication.

Affected Products

• Socket.IO versions prior to 4.6.2
• Socket.IO 2.x branch prior to the backported fix (commit d30630ba10)
• Node.js applications utilizing vulnerable Socket.IO versions

Discovery Timeline

• 2023-05 - Socket.IO releases security patch in version 4.6.2
• 2024-06-19 - CVE-2024-38355 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-38355

Vulnerability Analysis

This vulnerability exists due to insufficient error handling in the Socket.IO library when processing incoming packets. When a malformed or specially crafted packet is received by the server, it triggers an uncaught exception within the Socket class. Node.js applications that do not have proper global exception handlers will terminate when such exceptions occur, leading to a complete denial of service.

The vulnerability is particularly concerning because it can be exploited remotely without any authentication requirements. An attacker only needs network access to the Socket.IO server endpoint to send malicious packets. The attack complexity is low, making it accessible to attackers with minimal technical sophistication.

Root Cause

The root cause lies in the Socket class not having a default handler for the "error" event. In Node.js EventEmitter-based classes, when an "error" event is emitted and no listener is attached, Node.js throws an uncaught exception by default. The Socket.IO Socket class was missing this safeguard, allowing malformed packets to emit error events that would crash the entire Node.js process.

Attack Vector

The attack vector is network-based, requiring an attacker to send specially crafted Socket.IO packets to the target server. The attack can be executed from anywhere with network connectivity to the vulnerable application. Since Socket.IO connections are typically exposed to handle real-time communication features, the attack surface is often directly accessible from the internet.

The following patch from lib/socket.ts shows the fix implemented in Socket.IO 4.6.2:

       }
     }
     this.handshake = this.buildHandshake(auth);

+    // prevents crash when the socket receives an "error" event without listener
+    this.on("error", noop);
   }

   /**

Source: GitHub Commit 15af22fc22

The corresponding fix for the 2.x branch in lib/socket.js:

 
 var emit = Emitter.prototype.emit;
 
+function noop() {}
+
 /**
  * Interface to a `Client` for a given `Namespace`.
  *

Source: GitHub Commit d30630ba10

Detection Methods for CVE-2024-38355

Indicators of Compromise

• Unexpected Node.js process crashes or restarts without apparent cause
• Application logs showing uncaught exceptions related to Socket.IO error events
• Unusual Socket.IO connection patterns or malformed packet payloads in network traffic
• Multiple rapid reconnection attempts from the same client IP addresses

Detection Strategies

• Monitor application crash logs for uncaught exceptions originating from Socket.IO modules
• Implement network-level inspection for malformed WebSocket/Socket.IO packets
• Set up alerting on Node.js process restart frequency exceeding normal thresholds
• Review dependency manifests for Socket.IO versions prior to 4.6.2

Monitoring Recommendations

• Configure process monitoring tools (PM2, systemd, etc.) to alert on unexpected restarts
• Enable verbose logging for Socket.IO connection and error events
• Implement application performance monitoring (APM) to track exception rates
• Set up network traffic analysis to detect anomalous Socket.IO communication patterns

How to Mitigate CVE-2024-38355

Immediate Actions Required

• Upgrade Socket.IO to version 4.6.2 or later immediately
• For 2.x branch users, apply the backported fix from commit d30630ba10
• Audit all applications using Socket.IO for vulnerable versions
• Implement rate limiting on Socket.IO endpoints to reduce attack impact

Patch Information

The vulnerability has been fixed in Socket.IO version 4.6.2 (released May 2023) through commit 15af22fc22. The fix was also backported to the 2.x branch with commit d30630ba10. Users should update their package.json dependencies to require socket.io@>=4.6.2 or apply the relevant fix for their branch. For additional technical details, refer to the GitHub Security Advisory.

Workarounds

• Attach a listener for the "error" event on Socket.IO sockets to catch exceptions before process crash
• Implement a global uncaught exception handler in Node.js to prevent process termination
• Use process managers like PM2 with automatic restart to minimize downtime during attacks
• Deploy Socket.IO behind a reverse proxy with connection rate limiting

# Configuration example - Update Socket.IO in package.json
npm update socket.io@^4.6.2

# Workaround: Add error listener to socket connections
# In your Socket.IO server code, add:
# io.on("connection", (socket) => {
#   socket.on("error", (err) => {
#     console.error("Socket error:", err);
#   });
# });