CVE-2022-25872: Out-of-bounds Read in fast-string-search
Summary
CVE-2022-25872: Out-of-bounds Read in fast-string-search. Affects fast-string-search versions < 1.4.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fast-string-search package is an npm package that provides fast string search functionality. It is used to search for specific patterns within strings efficiently. However, all versions of the package are vulnerable to an Out-of-bounds Read issue. This vulnerability occurs due to incorrect memory freeing and length calculation for any non-string input as the source. As a result, an attacker can read previously allocated memory, potentially leading to information disclosure or other security issues.
Vulnerability Detail
The Out-of-bounds Read vulnerability in fast-string-search allows an attacker to access memory that is outside the bounds of an allocated buffer. This can occur when the package tries to free memory or calculate the length of a non-string input. By exploiting this vulnerability, an attacker can read sensitive information from previously allocated memory, which may include passwords, cryptographic keys, or other confidential data. The impact of this vulnerability depends on the specific data stored in the memory and how it is used by the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to avoid using non-string inputs as the source for fast-string-search. By ensuring that only valid string inputs are used, the vulnerability can be mitigated. Developers can add input validation checks to their code to prevent non-string inputs from being passed to the vulnerable functions. Here's an example of how to validate the input in JavaScript:
function search(input) {
if (typeof input !== 'string') {
throw new Error('Invalid input: input must be a string.');
}
// Perform the search
}
Conclusion
The Out-of-bounds Read vulnerability in the fast-string-search package can allow an attacker to read previously allocated memory. This can lead to information disclosure or other security issues depending on the data stored in the memory. It is crucial to update the package to a patched version (1.4.4 or later) to mitigate this vulnerability. Developers should also consider implementing input validation checks to prevent non-string inputs from being passed to the vulnerable functions. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for fast-string-search →
FAQ
The impact of this vulnerability depends on the specific data stored in the memory and how it is used by the application. It could potentially lead to information disclosure or other security issues if sensitive data is present in the memory.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to patch the vulnerability as soon as possible to prevent any potential exploitation.
Yes, all versions of the fast-string-search package are vulnerable to this Out-of-bounds Read issue. It is recommended to update to version 1.4.4 or later to fix the vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
For more information about this vulnerability, you can refer to the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-hmqg-p8f8-3qrw/GHSA-hmqg-p8f8-3qrw.json). It contains detailed information about the vulnerability, including its severity, affected versions, and any available patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-string-search.
