Executive brief
The 'ms' library, a popular utility for converting time strings to milliseconds in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted, extremely long time string that causes the application to consume excessive CPU resources while trying to process it. This can lead to the application becoming unresponsive or crashing, potentially disrupting business operations and service availability.
Technical details
The 'ms' package (versions prior to 0.7.1) contains a Regular Expression Denial of Service (ReDoS) vulnerability (CWE-1333). The root cause is an inefficient regular expression used to parse time strings into milliseconds. An unauthenticated remote attacker can exploit this by providing a maliciously crafted, long input string (e.g., thousands of characters followed by a specific suffix), causing the regex engine to enter a state of catastrophic backtracking. This results in 100% CPU utilization and can hang the Node.js event loop, leading to a complete denial of service for the affected application. The issue is fixed in version 0.7.1.
Affected products
- Vercel ms < 0.7.1
Timeline
- 2015-11-25: disclosed: Vulnerability identified/CVE assigned
- 2017-01-23: advisory: NVD published date
- 2017-10-24: advisory: GitHub Advisory published
References
- https://github.com/unshiftio/millisecond
- https://nodesecurity.io/advisories/46
- https://support.f5.com/csp/article/K46337613?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K46337613?utm_source=f5support&utm_medium=RSS
- https://web.archive.org/web/20200227190911/http://www.securityfocus.com/bid/96389
- http://www.openwall.com/lists/oss-security/2016/04/20/11