heartbleed.js

// Javascript implementation of the Heartbleed bug

var memory = '';

var heartbleed = function (msg, len) {
  if (msg.length === 0) {
    throw 'Message must not be blank';
  }
  len = len || msg.length;
  
  if (typeof len !== 'number')
    throw 'Length must be a number';
  
  len = Math.floor(Math.abs(len));
  if (len > 64)
    throw 'Length must be smaller than 64';
  memory += msg;
  if (memory.length > 64)
  memory = memory.slice(-64);
  return memory.slice(-1 * len);
};

The server is given a message and is supposed to echo it back, but allows you to manually give the length of your message – meaning that if you write a 5 character message and tell the server its length is 10, it will give echo your message as well as 5 characters from a previous message.

Attackers could use this to send a 1-character message and give it a length of 64 (64-bits is the maximum length the server will accept), and retrieve sensitive information that was supposed to be kept secret.