Regular Expression Denial of Service (ReDoS)

Affecting brace-expansion package, versions <1.1.7

medium severity

Overview

brace-expansion is a package that performs brace expansion as known from sh/bash. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Many Regular Expression implementations may reach edge cases that causes them to work very slowly (exponentially related to input size), allowing an attacker to exploit this and can cause the program to enter these extreme situations by using a Regex string and cause the service to hang for a large periods of time.

An attacker can provide a long value to the expand function, which nearly matches the pattern being matched. This will cause the regular expression matching to take a long time, all the while occupying the event loop and preventing it from processing other requests and making the server unavailable (a Denial of Service attack). Running:

const expand = require('brace-expansion');
expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}')

Will hang for long periods of time.

You can read more about Regular Expression Denial of Service (ReDoS) on our blog.

Remediation

Upgrade brace-expansion to version 1.1.7 or higher.

References

Credit
kamael
CWE
CWE-400
Snyk ID
npm:brace-expansion:20170302
Disclosed
01 Mar, 2017
Published
26 Apr, 2017

Do your applications use this vulnerable package?