Regular Expression Denial of Service (ReDoS)

Affecting validator package, versions >=5.2.0 <9.4.1

Do your applications use this vulnerable package? Test your applications

Overview

validator is a A library of string validators and sanitizers.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). It used a regular expression (^\s*data:([a-z]+\/[a-z0-9\-\+]+(;[a-z\-]+=[a-z0-9\-]+)?)?(;base64)?,[a-z0-9!\$&',\(\)\*\+,;=\-\._~:@\/\?%\s]*\s*$) in order to validate Data URIs. This can cause an impact of about 10 seconds matching time for data 70K characters long.

Disclosure Timeline

  • Feb 15th, 2018 - Initial Disclosure to package owner
  • Feb 16th, 2018 - Initial Response from package owner
  • Feb 18th, 2018 - Fix issued
  • Feb 18th, 2018 - Vulnerability published

Remediation

Upgrade validator to version 9.4.1 or higher.

References

CVSS Score

3.7
low severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    None
  • Integrity
    None
  • Availability
    Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Credit
Jamie Davis
CWE
CWE-185 CWE-400
Snyk ID
npm:validator:20180218
Disclosed
18 Feb, 2018
Published
18 Feb, 2018