Executive brief
clean-css is a CSS minifier library used to optimize stylesheets in web applications. A regular expression vulnerability in versions prior to 4.1.11 allows attackers to submit specially crafted CSS input that causes the library to hang or become unresponsive, disrupting website availability and performance.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in clean-css's validation regex patterns. Untrusted CSS input triggers catastrophic backtracking in the regex engine due to inefficient pattern construction, allowing an attacker to craft input that causes polynomial or exponential computational complexity. The attack requires the application to process untrusted CSS input through clean-css (no authentication required if input comes from public-facing submission). An attacker can make the minifier computationally expensive, causing the application to hang or consume excessive CPU resources. The fix was implemented in version 4.1.11 by reworking vulnerable regex patterns and limiting whitespace blocks to 31 characters in validation regexes.
Affected products
- clean-css clean-css prior to 4.1.11
Timeline
- 2019-06-05: disclosed
- 2018-03-06: patched: Fix committed to repository; version 4.1.11 release date not explicitly stated but advisory published in 2019