CVE-2021-43308: Regular expression denial of service in markdown-link-extractor

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The markdown-link-extractor is an npm package used for extracting links from Markdown files. It provides a function that takes a Markdown string as input and returns an array of links found in the input. The package is commonly used in applications that need to parse Markdown files and extract links for further processing.

Vulnerability Detail

The markdown-link-extractor package is vulnerable to an exponential ReDoS (Regular Expression Denial of Service) attack. This vulnerability can be exploited when an attacker is able to supply arbitrary input to the module's exported function. By crafting a malicious input string that triggers a slow-running regular expression, an attacker can cause the function to consume excessive amounts of CPU time and potentially lead to a denial of service condition. The impact of this vulnerability is mainly on the availability of the application using the markdown-link-extractor package.

Workaround

If updating the package is not immediately feasible, a possible workaround is to implement input validation and sanitization before passing the input to the markdown-link-extractor function. By carefully validating and limiting the input, the risk of triggering the vulnerable regular expression can be reduced. Here is an example of how input validation can be implemented in JavaScript:

const markdownLinkExtractor = require('markdown-link-extractor');

function extractLinksSafely(markdown) {
  if (typeof markdown !== 'string' || markdown.length > 10000) {
    throw new Error('Invalid input');
  }

  return markdownLinkExtractor(markdown);
}

Conclusion

The markdown-link-extractor package is vulnerable to a ReDoS attack, which can lead to a denial of service condition. It is recommended to update the package to the latest patched version (3.0.2 or later) to mitigate the vulnerability. If immediate update is not possible, implementing input validation and sanitization can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for markdown-link-extractor →

FAQ