Regular Expression Denial of Service in Node.js ssri Module

Background

The ssri module is a part of Node.js and is used for integrity checking of files using subresource integrity (SRI). It provides functions to generate and verify integrity hashes for files. The ssri module is widely used in various applications and packages to ensure the integrity and security of files. However, versions before 5.2.2 of the ssri module for Node.js are vulnerable to a regular expression denial of service (ReDoS) attack in strict mode functionality. This vulnerability can be exploited by providing a long base64 hash string, causing the application to consume excessive CPU resources and potentially leading to a denial of service condition.

Vulnerability Detail

The vulnerability (CVE-2018-7651) in the ssri module allows an attacker to perform a ReDoS attack by providing a long base64 hash string. When the module tries to parse the hash string in strict mode, the regular expression used for parsing becomes highly inefficient due to backtracking. This can cause the application to become unresponsive or crash, leading to a denial of service. The severity of this vulnerability is rated as moderate with a CVSS score of 5.9.

sudo apt-get install --only-upgrade node-ssri

Workaround

If updating the ssri module is not immediately possible, a temporary workaround can be implemented by validating the length of the base64 hash string before passing it to the ssri module. By enforcing a reasonable length limit for the hash string, the risk of triggering the vulnerability can be mitigated. Here is an example of how to implement this workaround in Node.js:

const ssri = require('ssri');

function validateHash(hash) {
  if (hash.length > 1000) {
    throw new Error('Invalid hash length');
  }
}

const hash = '...'; // Base64 hash string

try {
  validateHash(hash);
  const integrity = ssri.parse(hash);
  // Use the integrity object
} catch (error) {
  // Handle validation error
}

Conclusion

The regular expression denial of service vulnerability in the ssri module for Node.js can be exploited by providing a long base64 hash string. This can lead to excessive CPU usage and potentially a denial of service condition. It is recommended to update the ssri module to version 5.2.2 or later to fix this vulnerability. If immediate update is not possible, implementing a length validation check for the hash string can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for node-ssri →

FAQ