Description (CNA)
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| sdelements / lets-chat | affected 0.4.0 through 0.4.8; affected 84981a6d2534445c00ea4e095c934e46943c0b1d through 617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c |
CWE
CWE-476
References
- https://github.com/theopaid/Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-
- https://www.vulncheck.com/advisories/let-s-chat-denial-of-service-via-null-dereference-in-room-lookup
ADP enrichment
No English description supplied.
No references supplied.