CVE-2018-25110: Marked Package Vulnerable to Regular Expression Denial of Service (ReDoS) Attack
Summary
CVE-2018-25110: Marked allows Regular Expression Denial of Service (ReDoS) attacks. Affects marked versions < 0.3.17. Fixed in 0.3.17. How to fix ↓
Also tracked for
- node-marked · Debian:11
The same CVE-2018-25110 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Marked is a popular JavaScript library used for parsing and converting Markdown into HTML. It is widely utilized in various applications due to its efficiency and flexibility in handling Markdown syntax. However, prior to version 0.3.17, Marked is susceptible to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact the performance and availability of applications using this package.
Vulnerability Detail
The vulnerability arises from catastrophic backtracking in several regular expressions utilized for parsing HTML tags and Markdown links. An attacker can exploit this by providing specially crafted Markdown input, such as deeply nested or repetitively structured brackets or tag attributes. This can cause the parser to hang indefinitely, leading to a Denial of Service, where legitimate users are unable to access the application.
How To Fix
Minimum fixed version
0.3.17
This is the first release that contains the fix.
npm install marked@0.3.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider sanitizing user input to prevent deeply nested structures or limiting the complexity of Markdown that can be processed. This can help mitigate the risk of triggering the ReDoS vulnerability.
Conclusion
The Marked package, prior to version 0.3.17, is vulnerable to a Regular Expression Denial of Service attack, which can lead to significant performance issues. It is crucial for developers to update to the patched version to safeguard their applications. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for marked →
FAQ
A ReDoS attack exploits the way certain regular expressions are processed, causing the application to consume excessive resources and potentially hang or crash.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Check your package-lock.json file for vulnerabilities.
Implement input sanitization or limit the complexity of Markdown input as a temporary measure to reduce the risk of exploitation.
You can visit the official GitHub repository for Marked or its documentation for more details on its usage and features.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for marked.
