Junglewise Threat Intelligence

CVE-2015-8854: marked project marked ReDoS in em inline rule

CVE-2015-8854 · Severity: high · CVSS 7.5 · Published 2017-01-23

Technologies: Marked Project Marked. Vendors: Marked Project.

Executive brief

The 'marked' library, a popular Markdown parser for Node.js, is vulnerable to a denial-of-service attack. An attacker can provide specially crafted Markdown text that causes the server to consume excessive CPU resources, potentially leading to a complete service outage. This can disrupt business operations by making applications that process user-supplied Markdown unresponsive.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the 'marked' library before version 0.3.4. The vulnerability is caused by catastrophic backtracking in the regular expression used for the 'em' (emphasis) inline rule. A remote, unauthenticated attacker can exploit this by submitting a specially crafted Markdown string that triggers inefficient processing, leading to high CPU utilization and a denial of service (DoS) condition. The issue was addressed in version 0.3.4, though some later advisories suggest further related fixes in version 0.3.9.

Affected products

  • marked_project marked < 0.3.4

Timeline

  • 2015-08-01: disclosed: Vulnerability identified in Node Security Advisory 23
  • 2017-01-23: advisory: NVD published CVE-2015-8854
  • 2020-05-31: patched: Fedora updates released for affected versions

References