Advisoriesby IbisWebSocket message can cause crash
Due to [CVE-2023-48230 in Cap'n Proto](https://github.com/capnproto/capnproto/security/advisories/GHSA-r89h-f468-62w3) (a library used by workerd), a remote client may be able to induce workerd to crash. Based on the details of the bug, we do not believe remote code execution can be achieved through this vulnerability, although we cannot completely rule it out.
The bug only affects Workers which accept WebSocket connections and process the messages in JavaScript or forward them to Durable Objects. (Workers that proxy WebSocket connections through to an origin server, without inspecting individual messages, are not affected.) Additionally, the WebSocket compression feature must be enabled. This feature is enabled by default for workers with a [compatibility date](https://developers.cloudflare.com/workers/configuration/compatibility-dates/) on or after 2023-08-15, or which have enabled the [websocket-compression compatibility flag](https://developers.cloudflare.com/workers/configuration/compatibility-dates/#websocket-compression).
This bug was discovered internally by the Cloudflare Workers team. Our production service is already patched and we do not believe it was ever exploited.
Patches
git commit: [70b60d0b40110a18e74d5a49f7db83afd50fd832](https://github.com/cloudflare/workerd/commit/70b60d0b40110a18e74d5a49f7db83afd50fd832)
workerd release:...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| workerd Product | < v1.20231121.0 | v1.20231121.0 |
Details and references
Due to [CVE-2023-48230 in Cap'n Proto](https://github.com/capnproto/capnproto/security/advisories/GHSA-r89h-f468-62w3) (a library used by `workerd`), a remote client may be able to induce `workerd` to crash. Based on the details of the bug, we do not believe remote code execution can be achieved through this vulnerability, although we cannot completely rule it out. The bug only affects Workers which accept WebSocket connections and process the messages in JavaScript or forward them to Durable Objects. (Workers that proxy WebSocket connections through to an origin server, without inspecting individual messages, are not affected.) Additionally, the WebSocket compression feature must be enabled. This feature is enabled by default for workers with a [compatibility date](https://developers.cloudflare.com/workers/configuration/compatibility-dates/) on or after `2023-08-15`, or which have enabled the [`websocket-compression` compatibility flag](https://developers.cloudflare.com/workers/configuration/compatibility-dates/#websocket-compression). This bug was discovered internally by the Cloudflare Workers team. Our production service is already patched and we do not believe it was ever exploited. ### Patches git commit: [70b60d0b40110a18e74d5a49f7db83afd50fd832](https://github.com/cloudflare/workerd/commit/70b60d0b40110a18e74d5a49f7db83afd50fd832) workerd release: [v1.20231121.0](https://github.com/cloudflare/workerd/releases/tag/v1.20231121.0)
- Severity from
- GitHub (reviewed advisory)