CVE-2016-10520: Regular Expression Denial of Service in jadedown
Summary
CVE-2016-10520: Regular Expression Denial of Service in jadedown. Affects jadedown versions < 0.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jadedown package is an npm package that provides a templating language for processing user input. It has not been actively maintained since 2011. The package is vulnerable to a regular expression denial of service (ReDoS) attack when certain types of user input are passed in.
Vulnerability Detail
The vulnerability in the jadedown package allows an attacker to cause a denial of service (DoS) by sending specially crafted input. This is due to the way the package handles regular expressions, which can be exploited to cause the application to hang or crash. The impact of this vulnerability can range from a temporary disruption of service to a complete system failure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If the jadedown package is used to process user input and cannot be immediately replaced, a possible workaround is to implement input validation and sanitization to prevent malicious input from triggering the vulnerability. This can be done by using libraries or custom code to validate and sanitize user input before passing it to the jadedown package.
Conclusion
The jadedown package is vulnerable to a regular expression denial of service (ReDoS) attack. Since the package is no longer actively maintained, the best solution is to refactor the dependent application to not use this module. Implementing input validation and sanitization can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jadedown →
FAQ
The impact of this vulnerability can range from a temporary disruption of service to a complete system failure, depending on the severity of the attack and the resources available to the attacker.
No, there is no patch available for this vulnerability as the jadedown package is no longer actively maintained. The recommended solution is to refactor the dependent application to not use this module.
Yes, a possible workaround is to implement input validation and sanitization to prevent malicious input from triggering the vulnerability. This can be done by using libraries or custom code to validate and sanitize user input before passing it to the jadedown package.
Yes, this vulnerability can be exploited remotely by sending specially crafted input to the application that uses the jadedown package.
There is no known public exploit for this vulnerability at the moment. However, the vulnerability is well-documented and can be easily exploited by an attacker with knowledge of the issue.
