CVE-2020-7755: Regular Expression Denial of Service in dat.gui
Summary
CVE-2020-7755: Regular Expression Denial of Service in dat.gui. Affects dat.gui versions < 0.7.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dat.gui is an npm package that provides a graphical user interface for changing variables in JavaScript. It is commonly used in web development projects to create interactive GUIs. The package allows developers to easily create panels with various controls, such as sliders, buttons, and color pickers, to manipulate variables in real-time. However, all versions of dat.gui are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when handling specifically crafted rgb and rgba values.
Vulnerability Detail
The vulnerability in dat.gui arises from the insecure handling of regular expressions when processing rgb and rgba values. An attacker can exploit this weakness by providing specially crafted input that triggers a ReDoS attack. This type of attack can cause the application to enter into an infinite loop, consuming excessive CPU resources and potentially leading to a denial of service. The impact of this vulnerability can range from degraded performance to a complete system freeze, depending on the severity of the attack. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-400.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating to the latest version is not immediately feasible, developers can implement a workaround to mitigate the risk of exploitation. One possible workaround is to sanitize the input values for rgb and rgba before passing them to dat.gui. This can be done by validating the input against a safe regular expression pattern or by using a library that provides secure parsing and validation of color values.
Conclusion
dat.gui is vulnerable to a Regular Expression Denial of Service (ReDoS) attack when processing rgb and rgba values. This vulnerability can lead to a denial of service, causing degraded performance or system freeze. To mitigate the risk, developers should update their dat.gui package to version 0.7.8 or later. If immediate update is not possible, sanitizing the input values can provide a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for dat.gui →
FAQ
dat.gui is an npm package that provides a graphical user interface for changing variables in JavaScript. It simplifies the process of creating interactive GUIs in web development projects.
A ReDoS (Regular Expression Denial of Service) attack is a type of security vulnerability that occurs when a regular expression pattern is susceptible to excessive backtracking. This can lead to a denial of service by causing the application to consume excessive CPU resources or enter into an infinite loop.
The consequences of this vulnerability can range from degraded performance to a complete system freeze. An attacker can exploit this vulnerability to cause a denial of service by triggering an infinite loop in the application's regular expression processing.
To fix this vulnerability, update your dat.gui package to version 0.7.8 or later. Run the command 'npm install dat.gui@0.7.8' to update the package.
If updating to the latest version is not immediately feasible, you can mitigate the risk by sanitizing the input values for rgb and rgba before passing them to dat.gui. Validate the input against a safe regular expression pattern or use a library that provides secure parsing and validation of color values.
