CVE-2020-36049 - Denial of Service Vulnerability

Abstract

Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

The engine.io package is vulnerable to Denial of Service (DoS) attacks. The constructor in server.js declares an insecure buffer limit of 100mb for requests. A remote attacker can exploit this vulnerability by leveraging the long polling transport to submit a large POST payload that may encapsulate multiple malicious packets. Processing this payload will cause the application to consume all available resources, ultimately resulting in a DoS condition.

The Oxygen Content Fusion product incorporates the engine.io as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

Syncro Soft recommands users of Content Fusion 3.0 or older to upgrade to Oxygen Content Fusion 4.0 or newer.

Detail

CVE-2020-36049

Severity: High

CVSS Score: 7.5

The engine.io package third-party library used by Oxygen Content Fusion software product is an affected version mentioned in CVE-2020-36048 vulnerability description.

Starting with Oxygen Content Fusion 4.0, we have limited the maximum size of a package to 1MB.

Therefore, the Oxygen Content Fusion product is not impacted by CVE-2020-36048.

Revision History

2022-10-13 Starting with Oxygen Content Fusion version 5.0 build 2022052605, the engine.io was updated to a non-vulnerable version.