CVE-2017-16115: Regular Expression Denial of Service in timespan
Summary
CVE-2017-16115: Regular Expression Denial of Service in timespan. Affects timespan versions < 2.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The timespan package is an npm package that is used for parsing and manipulating time spans in JavaScript. It provides functionality to parse time spans from strings and perform operations on them. However, versions of timespan prior to 2.3.0 are vulnerable to a regular expression denial of service (ReDoS) attack when parsing dates.
Vulnerability Detail
The vulnerability in timespan arises from the way it handles user input when parsing dates. An attacker can provide specially crafted input that triggers a ReDoS attack, causing the event loop to be blocked for a significant amount of time. This can lead to a denial of service situation where the application becomes unresponsive.
The amplification factor for this vulnerability is significant, with just 50,000 characters resulting in a 10-second blockage of the event loop.
This vulnerability has a low severity rating and is assigned CWE-400.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk of this vulnerability, it is recommended to use a functionally equivalent alternative package that is not vulnerable to ReDoS attacks. If using timespan is necessary, ensure that user input is properly validated and sanitized before passing it to the package. Additionally, limiting the maximum length of user input to 150 characters can help reduce the impact of a potential ReDoS attack.
Conclusion
The timespan package is vulnerable to a regular expression denial of service (ReDoS) attack when parsing dates. To mitigate the risk, it is recommended to use an alternative package or ensure that user input is properly validated and sanitized. Limiting the maximum length of user input can also help reduce the impact of a potential attack. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for timespan →
FAQ
This vulnerability can lead to a denial of service situation where the application becomes unresponsive. An attacker can exploit this vulnerability by providing specially crafted input, causing the event loop to be blocked for a significant amount of time.
ReDoS stands for Regular Expression Denial of Service. It is a type of attack where an attacker provides input that causes a regular expression to take a long time to process, leading to a denial of service situation.
This vulnerability has a low severity rating.
No, only versions prior to 2.3.0 are affected by this vulnerability.
No, there is no direct patch available for this vulnerability. The recommended solution is to use an alternative package or mitigate the risk by validating and sanitizing user input.
