CVE-2020-7661: Regular expression denial of service in url-regex
Summary
CVE-2020-7661: Regular expression denial of service in url-regex. Affects url-regex versions < 5.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The url-regex package is an npm package that provides a regular expression for matching URLs. It is commonly used in applications that need to validate or extract URLs from text. The package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack, where an attacker can provide a very long string that causes the regular expression matching to take an excessive amount of time, leading to a denial of service.
Vulnerability Detail
The vulnerability in url-regex arises from the way the regular expression is constructed and the lack of input validation. By providing a specially crafted string in the String.test function, an attacker can trigger a ReDoS attack. This can cause the application to become unresponsive or consume excessive CPU resources, leading to a denial of service. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a possible workaround is to implement input validation and limit the length of the input string before passing it to the String.test function. By enforcing a maximum length for the input, the impact of a potential ReDoS attack can be mitigated. Here is an example of how to implement input validation in JavaScript:
const urlRegex = require('url-regex');
function validateUrl(input) {
const maxLength = 1000; // Set the maximum allowed length
if (input.length > maxLength) {
throw new Error('Input exceeds maximum length');
}
return urlRegex().test(input);
}
Conclusion
The url-regex package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. It is recommended to update the package to a version that includes a fix for the vulnerability. If immediate update is not feasible, implementing input validation and limiting the length of the input string can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for url-regex →
FAQ
url-regex is an npm package that provides a regular expression for matching URLs. It is commonly used in applications that need to validate or extract URLs from text.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack where an attacker provides a specially crafted input that causes a regular expression to take an excessive amount of time to match. This can lead to the application becoming unresponsive or consuming excessive resources.
The url-regex vulnerability allows an attacker to trigger a ReDoS attack, leading to a denial of service. This can cause the application to become unresponsive or consume excessive CPU resources.
To fix the url-regex vulnerability, it is recommended to update the package to a version that includes a fix for the ReDoS vulnerability. Developers should check for updates in the npm registry and update their package.json file accordingly.
A possible workaround for the url-regex vulnerability is to implement input validation and limit the length of the input string before passing it to the vulnerable function. By enforcing a maximum length for the input, the impact of a potential ReDoS attack can be mitigated.
References
Related vulnerabilities
Recent vulnerabilities recorded for url-regex.
