Regular Expression Denial of Service Vulnerability in MooTools Package
Summary
DEBIAN-CVE-2021-32821: MooTools is a collection of JavaScript utilities for JavaScript developers. Affects mootools versions 1.4.5~debian1-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MooTools is a robust collection of JavaScript utilities designed for developers to enhance their web applications. It provides a variety of features including DOM manipulation, event handling, and AJAX support. However, all known versions of MooTools are vulnerable to a Regular Expression Denial of Service (ReDoS) due to a flaw in its CSS selector parser, which can be exploited when an attacker injects a malicious string into a CSS selector at runtime.
Vulnerability Detail
The vulnerability arises from MooTools' CSS selector parser, which is susceptible to Regular Expression Denial of Service (ReDoS). This occurs when an attacker can inject a specially crafted string into a CSS selector, leading to excessive backtracking and potential denial of service. The impact of this vulnerability can be severe, as it may allow an attacker to disrupt the functionality of web applications that rely on MooTools for CSS selector parsing. Currently, there are no patches available to address this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A potential workaround is to sanitize user inputs that are used in CSS selectors to prevent injection of malicious strings. Implementing strict validation on CSS selector inputs can help mitigate the risk of exploitation. For example, you can use a function to validate the input before passing it to MooTools' CSS selector parser.
Conclusion
The MooTools package is currently vulnerable to a Regular Expression Denial of Service attack due to flaws in its CSS selector parser. With no patches available, users are encouraged to implement input validation and consider alternative libraries to maintain application security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for mootools →
FAQ
ReDoS is a type of denial of service attack that exploits the way regular expressions are processed, causing excessive backtracking and potentially crashing the application.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Currently, there are no patches available for MooTools to fix this vulnerability. Users should keep an eye on the official repository for any updates.
Consider removing MooTools or replacing it with a more secure alternative until a patch is released. Additionally, implement input validation to mitigate risks.
Sanitize and validate all user inputs that are used in CSS selectors to prevent injection of malicious strings, and regularly update your dependencies.
References
Related vulnerabilities
Recent vulnerabilities recorded for mootools.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
