CVE-2017-16116: Regular Expression Denial of Service in string

Background

The string package is an npm package that provides various string manipulation functions. It is commonly used in JavaScript projects to simplify string operations. The package includes methods such as underscore and unescapeHTML which are vulnerable to regular expression denial of service (ReDoS) attacks when untrusted user input is passed into them.

Vulnerability Detail

The vulnerability in the string package allows an attacker to perform a ReDoS attack by providing specially crafted input to the underscore or unescapeHTML methods. This can lead to a denial of service situation where the application becomes unresponsive or crashes. The vulnerability affects versions 0.0.0 to 3.3.3 of the string package.

Workaround

To mitigate the vulnerability, it is recommended to implement input validation and sanitization before using the underscore and unescapeHTML methods. This can be done by using regular expressions with a timeout or by limiting the complexity of the input. Here is an example of input validation using a regular expression with a timeout:

const string = require('string');

function validateInput(input) {
  const regex = /^([a-zA-Z0-9]+)$/;
  const timeout = 1000; // Set a timeout of 1 second

  try {
    regex.test(input);
  } catch (error) {
    if (error instanceof Error && error.message.includes('potential ReDoS')) {
      throw new Error('Input validation failed: Potential ReDoS attack detected.');
    }
  }
}

Conclusion

The string package is vulnerable to regular expression denial of service attacks when untrusted user input is passed into the underscore or unescapeHTML methods. To mitigate the vulnerability, it is important to validate and sanitize user input before using these methods. Currently, there is no direct patch available, but implementing input validation and following best practices can help protect against this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for string →

FAQ