CVE-2017-18077: ReDoS in brace-expansion

Background

The brace-expansion package is an npm package that provides functionality for expanding and generating strings using brace expansion patterns. It allows users to generate combinations of strings based on a specified pattern. This package is vulnerable to a regular expression denial of service (ReDoS) condition.

Vulnerability Detail

The vulnerability in brace-expansion arises from a lack of input validation and sanitization. An attacker can exploit this by providing a specially crafted input that triggers a ReDoS condition. This can cause the application to consume excessive CPU resources and potentially lead to a denial of service. The vulnerability has a CVSS score of 7.5, indicating a high severity.

npm install brace-expansion@5.0.12

npm install brace-expansion@1.1.7

Workaround

If updating to the latest version is not immediately feasible, a temporary workaround is to avoid using the brace-expansion package or to implement input validation and sanitization measures to mitigate the risk of ReDoS attacks. Here is an example of input validation for brace expansion patterns:

const expand = require('brace-expansion');

function validateInput(input) {
  const MAX_PATTERN_LENGTH = 100;

  if (input.length > MAX_PATTERN_LENGTH) {
    throw new Error('Input pattern is too long.');
  }

  // Additional validation logic
}

const input = '{a,b,c}';

try {
  validateInput(input);
  expand(input);
} catch (error) {
  console.error('Error:', error.message);
}

Conclusion

The brace-expansion package is vulnerable to a ReDoS condition, which can lead to a denial of service. It is crucial to update to version 1.1.7 or later to mitigate this vulnerability. If immediate updating is not possible, implementing input validation and sanitization measures can provide temporary protection. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for brace-expansion →

FAQ