CVE-2022-25324: Denial of Service in bignum
Summary
CVE-2022-25324: Uncaught Exception in bignum. Affects bignum versions < 0.13.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm package bignum is a library that provides arbitrary-precision arithmetic in JavaScript. It allows developers to perform mathematical operations on large numbers with precision. However, all versions of bignum are vulnerable to a Denial of Service (DoS) attack due to a type-check exception in V8, the JavaScript engine used by Node.js. This vulnerability can be exploited by an attacker to crash the application, leading to a service outage.
Vulnerability Detail
The vulnerability in bignum arises from a type-check exception in V8 when verifying the type of the second argument to the .powm function. This exception causes V8 to crash, bypassing any try/catch blocks in the Node.js application. As a result, an attacker can send a specially crafted request that triggers this exception, causing the application to crash and become unavailable. The impact of this vulnerability is a Denial of Service, where legitimate users are unable to access the affected service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the bignum package is not immediately feasible, developers can implement a workaround by adding input validation to prevent the vulnerable function from being called with malicious inputs. By checking the type of the second argument before calling the .powm function, developers can avoid triggering the type-check exception and mitigate the vulnerability. Here's an example of how the input validation can be implemented in JavaScript:
function powm(base, exponent, modulus) {
if (typeof exponent !== 'number') {
throw new Error('Exponent must be a number');
}
// Rest of the code
}
Conclusion
The bignum package is vulnerable to a Denial of Service (DoS) attack due to a type-check exception in V8. Developers should update to version 0.13.2 or later to fix the vulnerability. In the meantime, implementing input validation can serve as a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bignum →
FAQ
The impact of this vulnerability is a Denial of Service (DoS) attack, where an attacker can crash the application, rendering it unavailable to legitimate users.
To fix this vulnerability, update the bignum package to version 0.13.2 or later. Alternatively, implement input validation to prevent the vulnerable function from being called with malicious inputs.
Yes, all versions of the bignum package are vulnerable to this Denial of Service (DoS) vulnerability.
Yes, developers can implement input validation to mitigate the vulnerability until the package is updated. See the 'workaround' section for an example.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to the affected application.
References
Related vulnerabilities
Recent vulnerabilities recorded for bignum.
