CVE-2021-27405: Regular expression Denial of Service in @progfay/scrapbox-parser
Summary
CVE-2021-27405: Regular expression Denial of Service in @progfay/scrapbox-parser. Affects @progfay/scrapbox-parser across 2 version ranges.
< 6.0.3
>= 7.0.0, < 7.0.2
Fixed in 6.0.3 or 7.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @progfay/scrapbox-parser package is an npm package used for parsing text in the Scrapbox format. It provides functionality to convert Scrapbox text into HTML or JSON format. The package is commonly used in Node.js applications that require parsing and processing Scrapbox text.
Vulnerability Detail
A Regular expression Denial of Service (ReDoS) vulnerability has been identified in versions before 6.0.3 and 7.0.2 of the @progfay/scrapbox-parser package. This vulnerability allows an attacker to craft a specially formatted text that, when parsed by the package, can cause the application to consume excessive CPU resources. The vulnerability arises due to inefficient regular expressions used in the parsing process. An attacker who can provide the malicious input can potentially disrupt the availability of the affected application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.0.36.0.3npm install @progfay/scrapbox-parser@6.0.3 -
>= 7.0.0, < 7.0.27.0.2npm install @progfay/scrapbox-parser@7.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is advised to avoid parsing text with a large number of '[' characters. By reducing the usage of these characters in the input text, the likelihood of triggering the vulnerability is minimized.
Conclusion
The @progfay/scrapbox-parser package is vulnerable to a Regular expression Denial of Service (ReDoS) vulnerability. To mitigate this vulnerability, it is crucial to update the package to version 6.0.3 or 7.0.2 (or later). Avoiding the parsing of text with a large number of '[' characters can also reduce the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @progfay/scrapbox-parser →
FAQ
The vulnerability allows an attacker to cause the affected application to consume excessive CPU resources, potentially leading to denial of service or performance degradation.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will provide real-time alerts for open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to promptly update the @progfay/scrapbox-parser package to mitigate the risk.
No, the vulnerability is inherent to the @progfay/scrapbox-parser package and can only be fully addressed by updating to the patched versions.
Yes, you can find more information about this vulnerability in the GitHub advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-9fhw-r42p-5c7r/GHSA-9fhw-r42p-5c7r.json
