CVE-2018-1107: is-my-json-valid - ReDoS when validating JSON fields with email format
Summary
CVE-2018-1107: nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format. Affects is-my-json-valid versions < 2.17.2, 1.4.1. Fixed in 2.17.2, 1.4.1. How to fix ↓
Also tracked for
- is-my-json-valid · npm
The same CVE-2018-1107 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
is-my-json-valid is a JavaScript library used for validating JSON data. It provides a way to define JSON schemas and validate JSON objects against those schemas. The library is widely used in Node.js applications for data validation. However, in version 2.15.0, is-my-json-valid introduced a vulnerability that could lead to a ReDoS (Regular Expression Denial of Service) attack when validating JSON fields with email format.
Vulnerability Detail
The vulnerability in is-my-json-valid arises from the use of an inefficient regular expression to validate JSON fields defined as email format. An attacker can exploit this vulnerability by providing a specially crafted JSON file that triggers excessive CPU usage during validation. This can result in a denial of service (DoS) condition, where the application becomes unresponsive or crashes due to the high CPU consumption. The impact of this vulnerability can be severe, especially in scenarios where the application processes a large number of JSON inputs.
How To Fix
Minimum fixed version
2.17.2, 1.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to a fixed version is not immediately feasible, a temporary workaround is to implement input validation on the server-side to detect and reject malicious JSON inputs. This can be done by using a more efficient regular expression or by using a different JSON validation library that is not affected by this vulnerability.
Conclusion
The is-my-json-valid library version 2.15.0 is vulnerable to a ReDoS attack when validating JSON fields with email format. It is crucial to update to version 2.17.2 or 1.4.1 to mitigate this vulnerability. If an immediate update is not possible, implementing server-side input validation can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for is-my-json-valid →
FAQ
is-my-json-valid is a JavaScript library used for validating JSON data against predefined schemas. It helps ensure that the received JSON data conforms to the expected structure and format.
ReDoS stands for Regular Expression Denial of Service. It is a type of vulnerability where a maliciously crafted input can cause a regular expression matching algorithm to exhibit exponential time complexity, leading to excessive CPU usage and potential denial of service.
An attacker can exploit this vulnerability by providing a specially crafted JSON file with email format fields. When the file is validated using is-my-json-valid, the inefficient regular expression used for email validation triggers excessive CPU usage, potentially causing a denial of service.
The vulnerability can result in a denial of service (DoS) condition, where the affected application becomes unresponsive or crashes due to high CPU consumption. This can impact the availability and reliability of the application, potentially leading to financial losses or reputational damage.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including CVE-2018-1107.
Related vulnerabilities
Recent vulnerabilities recorded for is-my-json-valid.
