CVE-2016-4055: Regular Expression Denial of Service in moment

Background

Moment is a popular JavaScript library used for parsing, manipulating, and displaying dates and times. It provides a simple and intuitive API for working with dates and times in various formats. However, versions of Moment prior to 2.11.2 are affected by a regular expression denial of service (ReDoS) vulnerability. This vulnerability can be triggered when arbitrary user input is passed into the moment.duration() function.

Vulnerability Detail

The regular expression denial of service vulnerability in Moment arises from the way it handles user input in the moment.duration() function. When a large input string is provided, the regular expression used for parsing the input can exhibit exponential time complexity, leading to a denial of service condition. An attacker could exploit this vulnerability by providing a specially crafted input string, causing the application to consume excessive CPU resources and potentially become unresponsive. The severity of this vulnerability is moderate, with a CVSS score of 6.5.

npm install moment@2.31.0

npm install moment@2.11.2

Workaround

If updating to the latest version of Moment is not immediately feasible, a possible workaround is to validate and sanitize user input before passing it to the moment.duration() function. By implementing input validation and limiting the length of the input string, the risk of triggering the vulnerability can be mitigated. Here is an example of how input validation can be performed in JavaScript:

function sanitizeInput(input) {
  // Perform input validation and sanitization
  // Limit the length of the input string
  if (input.length > MAX_LENGTH) {
    throw new Error('Input string is too long');
  }

  return input;
}

var userInput = '-1234567890';
var sanitizedInput = sanitizeInput(userInput);
moment.duration(sanitizedInput);

Conclusion

In conclusion, the Moment library prior to version 2.11.2 is vulnerable to a regular expression denial of service (ReDoS) issue. This vulnerability can be mitigated by updating to the latest version of the library or implementing input validation and sanitization. It is important to promptly address this vulnerability to ensure the security and stability of applications using Moment. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for moment →

FAQ