WebSocket message can cause crash
MediumCVE-2023-48230 · Published Nov 21, 2023
Due to [CVE-2023-48230 in Cap'n Proto](https://github.com/capnproto/capnproto/security/advisories/GHSA-r89h-f468-62w3) (a library used by `workerd`), a remote client may be able to induce `workerd` to crash. Based on the details of the bug, we do not believe remote code execution can be achieved through this vulnerability, although we cannot completely rule it out. The bug only affects Workers which accept WebSocket connections and process the messages in JavaScript or forward them to Durable Objects. (Workers that proxy WebSocket connections through to an origin server, without inspecting individual messages, are not affected.) Additionally, the WebSocket compression feature must be enabled. This feature is enabled by default for workers with a [compatibility date](https://developers.cloudflare.com/workers/configuration/compatibility-dates/) on or after `2023-08-15`, or which have enabled the [`websocket-compression` compatibility flag](https://developers.cloudflare.com/workers/configuration/compatibility-dates/#websocket-compression). This bug was discovered internally by the Cloudflare Workers team. Our production service is already patched and we do not believe it was ever ex...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| workerd Product | < v1.20231121.0 | v1.20231121.0 |
Details and references
Due to [CVE-2023-48230 in Cap'n Proto](https://github.com/capnproto/capnproto/security/advisories/GHSA-r89h-f468-62w3) (a library used by `workerd`), a remote client may be able to induce `workerd` to crash. Based on the details of the bug, we do not believe remote code execution can be achieved through this vulnerability, although we cannot completely rule it out. The bug only affects Workers which accept WebSocket connections and process the messages in JavaScript or forward them to Durable Objects. (Workers that proxy WebSocket connections through to an origin server, without inspecting individual messages, are not affected.) Additionally, the WebSocket compression feature must be enabled. This feature is enabled by default for workers with a [compatibility date](https://developers.cloudflare.com/workers/configuration/compatibility-dates/) on or after `2023-08-15`, or which have enabled the [`websocket-compression` compatibility flag](https://developers.cloudflare.com/workers/configuration/compatibility-dates/#websocket-compression). This bug was discovered internally by the Cloudflare Workers team. Our production service is already patched and we do not believe it was ever exploited. ### Patches git commit: [70b60d0b40110a18e74d5a49f7db83afd50fd832](https://github.com/cloudflare/workerd/commit/70b60d0b40110a18e74d5a49f7db83afd50fd832) workerd release: [v1.20231121.0](https://github.com/cloudflare/workerd/releases/tag/v1.20231121.0)
- Severity from
- GitHub (reviewed advisory)
More Cloudflare advisories
All Cloudflare| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 82024 | Kyber: timing side-channel (kyberslash2) | High | 1.3.7 |
| Dec 292023 | Arbitrary remote code execution within `wrangler dev` Workers sandbox | High8.5 | 3.19.0+1 more |
| Dec 292023 | Arbitrary remote file read in Wrangler dev server | Medium6.9 | 3.19.0 |
| Dec 292023 | Server-Side Request Forgery (SSRF) in Miniflare | High8.0 | 3.20231030.2 |
| Dec 122023 | Unbounded queuing of path validation messages in cloudflare-quiche | Medium5.3 | 0.19.1 |
| Dec 52023 | Resource exhaustion via memory leak in tokio-boring | Medium5.3 | 4.1.0 |