Regular Expression Denial of Service in node-mime

Background

node-mime is a package used in the Debian ecosystem for performing mime lookups. It is responsible for determining the MIME type of a file based on its extension. This package is widely used in various Debian versions. However, versions prior to 2.3.1-1 are vulnerable to a regular expression denial of service (ReDoS) attack when performing a mime lookup on untrusted user input.

Vulnerability Detail

The vulnerability (CVE-2017-16138) arises from the lack of proper input validation in the mime module. When untrusted user input is passed to the mime lookup function, it triggers a regular expression that can be exploited to cause a denial of service. An attacker can craft malicious input that causes the regular expression to take an excessive amount of time to execute, leading to a significant impact on system performance and availability.

sudo apt-get install --only-upgrade node-mime

Workaround

As a workaround, it is advised to implement input validation and sanitization when using the mime module. This can involve validating user input for known patterns or limiting the input length to prevent excessive execution time of the regular expression. Here is an example of input validation using a regular expression in JavaScript:

const user_input = getUserInput();
const valid_pattern = /^[a-zA-Z0-9]+$/;

if (valid_pattern.test(user_input)) {
  // Proceed with mime lookup
} else {
  // Handle invalid input
}

Conclusion

In conclusion, the node-mime package in Debian versions prior to 2.3.1-1 is vulnerable to a regular expression denial of service attack. It is crucial to update the package to the fixed version to mitigate this vulnerability. Implementing input validation and sanitization can also provide additional protection. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for node-mime →

FAQ