Regular Expression Denial of Service (ReDoS) Vulnerability in MooTools Package

Background

MooTools is a robust collection of JavaScript utilities designed for developers, enabling them to create dynamic web applications with ease. It provides a range of features, including DOM manipulation, event handling, and AJAX capabilities. However, all known versions of MooTools contain a CSS selector parser that is susceptible to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact application performance and availability.

Vulnerability Detail

The vulnerability arises from the CSS selector parser within MooTools, which allows an attacker to inject a malicious string into a CSS selector at runtime. This is particularly concerning as such injections are common in scenarios involving jQuery CSS selectors. The ReDoS attack exploits the way regular expressions are processed, potentially leading to significant delays and resource exhaustion. As a result, applications utilizing MooTools may become unresponsive, affecting user experience and system stability.

Workaround

As a temporary workaround, you can implement input validation to restrict the types of strings that can be injected into CSS selectors. This can be done by using a whitelist approach to allow only safe and expected values. For example, you can create a function to validate the input as follows:

function validateCSSSelector(selector) {
    const regex = /^[a-zA-Z0-9-_.#]+$/; // Adjust regex as needed
    return regex.test(selector);
}

// Usage
if (validateCSSSelector(userInput)) {
    // Safe to use the selector
} else {
    // Handle invalid input
}

Conclusion

The CVE-2021-32821 vulnerability in MooTools poses a significant risk due to its susceptibility to ReDoS attacks. While there are currently no patches available, developers should take proactive measures to validate input and consider alternative libraries. Utilizing tools like Vulert can help monitor for vulnerabilities in real-time.

See every vulnerability recorded for mootools →

FAQ