CVE-2021-23567: Denial of Service (DoS) in colors.js
Summary
CVE-2021-23567: Infinite Loop in colors.js. Affects colors versions >= 1.4.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The colors package is an npm package that provides a set of utilities for working with colors in JavaScript. It allows developers to easily manipulate and display colors in various formats. The package is widely used in web development projects and has a large user base. However, versions after 1.4.0 are vulnerable to a Denial of Service (DoS) attack due to an intentional infinite loop introduced in the americanFlag module. This malicious code was added by a maintainer of the package, who revoked other maintainers' controls to prevent them from fixing the issue.
Vulnerability Detail
The vulnerability in the colors package allows an attacker to trigger an infinite loop in the americanFlag module, leading to a Denial of Service (DoS) condition. By exploiting this vulnerability, an attacker can cause the application using the colors package to become unresponsive or crash, resulting in a disruption of service. The vulnerability was introduced in versions after 1.4.0 and can be triggered by a simple loop that iterates from 666 to Infinity. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package to version 1.4.0 is not feasible, a possible workaround is to manually modify the colors.js file in the node_modules directory. The malicious code can be removed by deleting the following lines:
for (let i = 666; i < Infinity; i++;) {
// malicious code
}
Conclusion
The colors package is vulnerable to a Denial of Service (DoS) attack due to an intentional infinite loop introduced in the americanFlag module. To mitigate this vulnerability, it is recommended to update the package to version 1.4.0 or apply the provided workaround. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for colors →
FAQ
The colors package is an npm package that provides utilities for working with colors in JavaScript. It is commonly used in web development projects to manipulate and display colors.
The vulnerability allows an attacker to trigger an infinite loop in the colors package, leading to a Denial of Service (DoS) condition. This can cause the application to become unresponsive or crash, resulting in a disruption of service.
To fix the vulnerability, it is recommended to pin the dependency to version 1.4.0 of the colors package. This can be done by updating the package.json file in the project and specifying the exact version of the colors package to use.
Yes, if updating the package is not feasible, a possible workaround is to manually modify the colors.js file in the node_modules directory. The malicious code can be removed by deleting the lines that contain the infinite loop.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for colors.
