Regular Expression Denial of Service in underscore.string
Summary
GHSA-v2p6-4mp7-3r9v: Regular Expression Denial of Service in underscore.string. Affects underscore.string versions < 3.3.5. Fixed in 3.3.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
underscore.string is an npm package that provides additional string manipulation functions to the Underscore.js library. It extends the functionality of Underscore.js by adding methods for string manipulation, such as trimming, capitalizing, and escaping HTML entities. However, versions of underscore.string prior to 3.3.5 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The vulnerability in underscore.string lies in the unescapeHTML function, which is susceptible to ReDoS due to an overly-broad regular expression. This vulnerability can be exploited by an attacker to cause a denial of service by providing a specially crafted input that triggers the exponential growth of the regular expression matching time. The slowdown can be significant, with an approximate 2-second delay for 50,000 characters, and it grows exponentially with larger inputs.
How To Fix
Minimum fixed version
3.3.5
This is the first release that contains the fix.
npm install underscore.string@3.3.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
In conclusion, underscore.string versions prior to 3.3.5 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. It is crucial to upgrade to version 3.3.5 or higher to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for underscore.string →
FAQ
underscore.string is an npm package that extends the functionality of Underscore.js by providing additional string manipulation functions.
ReDoS stands for Regular Expression Denial of Service. It is a type of vulnerability where a maliciously crafted input can cause a regular expression matching algorithm to exhibit exponential time complexity, leading to a denial of service.
This vulnerability can be exploited by an attacker to cause a denial of service by providing a specially crafted input that triggers the exponential growth of the regular expression matching time.
To fix this vulnerability, it is recommended to upgrade to version 3.3.5 or higher of underscore.string.
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
