SockJS v0.3.19 calls res.end instead of res.write when receiving websocket upgrade requests. This causes an Error [ERR_STREAM_WRITE_AFTER_END]: write after end which crashes the container running the app utilising the vulnerable SockJS.
Vulnerable versions affected:
- Meteor JS <1.10.2 which use SockJS 0.3.19
- SockJS 0.3.19
This POC is targeted towards vulnerable MeteorJS apps running SockJS on /sockjs. To customise for other web apps running SockJS, change the payloads from /sockjs to corresponding routes managed by SockJS.
Install Python, then run in cmd/terminal:
pip install requests
python poc.py --target <domain>
A demo Meteor app running the vulnerable sockjs has been included. To test the exploit on this demo app, install Meteor from https://www.meteor.com/install and then:
cd demo/
meteor
And then point the payload target to http://localhost:3000
Update SockJS to 0.3.20