CVE-2020-7767: Regular Expression Denial of Service in express-validators
Summary
CVE-2020-7767: Regular expression deinal of service in express-validators. Affects express-validators versions < 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The express-validators package is an npm package used for validating URLs in Express.js applications. It provides a set of functions to validate and sanitize user input. The package is widely used in web development projects that utilize Express.js for server-side routing and request handling. However, all versions of the package are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when validating specifically-crafted invalid URLs.
Vulnerability Detail
The vulnerability in express-validators arises from a regular expression used for URL validation. An attacker can exploit this vulnerability by providing a specially crafted invalid URL that triggers a ReDoS attack. This can lead to a denial of service condition, where the application becomes unresponsive or consumes excessive CPU resources. The severity of this vulnerability is moderate, with a CVSS score of 5.3. It is important to note that this vulnerability only affects versions 0.0.1 to 1.0.4 of the express-validators package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround can be implemented by manually validating URLs using a different approach. Instead of relying on the express-validators package, developers can use alternative URL validation libraries or implement custom validation logic. Here's an example of how to validate a URL using the 'url' module in Node.js:
const url = require('url');
function validateUrl(input) {
try {
const parsedUrl = new URL(input);
return true;
} catch (error) {
return false;
}
}
Conclusion
The express-validators package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack when validating specifically-crafted invalid URLs. To mitigate this vulnerability, it is crucial to update the package to a version that includes a patch for the ReDoS vulnerability. Alternatively, developers can implement a temporary workaround by manually validating URLs using alternative libraries or custom logic. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for express-validators →
FAQ
express-validators is an npm package used for validating URLs in Express.js applications. It provides functions to validate and sanitize user input.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack that exploits the exponential time complexity of certain regular expressions. By providing specially crafted input, an attacker can cause the regular expression matching algorithm to take an excessive amount of time, leading to a denial of service condition.
The vulnerability in express-validators can lead to a denial of service condition in affected applications. This can result in unresponsive or slow application performance, potentially impacting user experience and causing service disruptions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze your dependencies and alert you if any vulnerabilities, including CVE-2020-7767, are found.
Yes, the maintainers of the express-validators package have released patches to address the ReDoS vulnerability. It is recommended to update the package to the latest version to mitigate the risk.
