Regular Expression Denial of Service (ReDoS) in node-brace-expansion
Summary
CVE-2017-18077: index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters. Affects node-brace-expansion across 2 version ranges.
< 1.1.8-1
< 892512024872ca7680554be90f6e8ce065053372
Fixed in 1.1.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-brace-expansion is a package used for expanding brace patterns in strings. It allows users to generate all possible combinations of a given pattern. This package is commonly used in Node.js applications for tasks such as file globbing and command-line argument expansion. However, versions before 1.1.8-1 are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2017-18077, originates from a flaw in the index.js file of the brace-expansion package. It can be exploited by providing an expand argument containing a large number of comma characters. This triggers a ReDoS attack, causing the application to consume excessive CPU resources and potentially leading to a denial of service. The severity of this vulnerability is rated as high, with a CVSS score of 7.5.
How To Fix
Minimum fixed version
1.1.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-brace-expansionTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version to mitigate the risk of exploitation.
Conclusion
The Regular Expression Denial of Service (ReDoS) vulnerability in node-brace-expansion can be mitigated by updating the package to version 1.1.8-1 or later. It is crucial to apply this update to protect your application from potential denial-of-service attacks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-brace-expansion →
FAQ
node-brace-expansion is a package used for expanding brace patterns in strings. It is commonly used in Node.js applications for tasks such as file globbing and command-line argument expansion.
A ReDoS (Regular Expression Denial of Service) attack is a type of denial-of-service attack that exploits the way regular expressions are processed. By providing a malicious input that triggers a regex pattern with exponential time complexity, an attacker can cause the application to consume excessive CPU resources and potentially become unresponsive.
This vulnerability allows an attacker to launch a ReDoS attack against applications using the vulnerable node-brace-expansion package. By exploiting this vulnerability, an attacker can cause the application to consume excessive CPU resources, potentially leading to a denial of service.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
You can find more information about this vulnerability, including the CVE details and fix, in the CVE-2017-18077.json file available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-18077.json
Related vulnerabilities
Recent vulnerabilities recorded for node-brace-expansion.
