Regular Expression Denial of Service in millisecond

Background

The millisecond package is an npm package that provides a utility for parsing and converting time durations in various formats. It allows developers to easily convert time durations from strings to milliseconds. The package is commonly used in JavaScript applications to handle time-related operations.

Vulnerability Detail

Versions of millisecond prior to 0.1.2 are affected by a regular expression denial of service (ReDoS) vulnerability. This vulnerability occurs when extremely long version strings are parsed, leading to excessive backtracking in the regular expression engine. An attacker can exploit this vulnerability by providing a maliciously crafted version string, causing the application to consume excessive CPU resources and potentially leading to a denial of service (DoS) condition. The impact of this vulnerability can range from performance degradation to complete unavailability of the affected application.

npm install millisecond@0.1.2

Workaround

If updating the millisecond package is not immediately feasible, a temporary workaround can be implemented by validating and limiting the length of the version string input before passing it to the millisecond package. This can be done by checking the length of the version string and rejecting inputs that exceed a reasonable limit. Here is an example of how this can be done in JavaScript:

const ms = require('millisecond');

function validateVersionString(version) {
  const MAX_LENGTH = 100;
  if (version.length > MAX_LENGTH) {
    throw new Error('Invalid version string');
  }
}

try {
  validateVersionString('1.2.3.4.5.6.7.8.9.10');
  ms('1.2.3.4.5.6.7.8.9.10');
} catch (error) {
  console.error('Error:', error.message);
}

Conclusion

In conclusion, the millisecond package prior to version 0.1.2 is vulnerable to a regular expression denial of service (ReDoS) vulnerability. This can be exploited by providing a maliciously crafted version string, leading to excessive CPU usage and potential denial of service. It is recommended to update the package to version 0.1.2 or later to mitigate this vulnerability. If immediate update is not possible, implementing a length validation workaround can help reduce the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for millisecond →

FAQ