Executive brief
is-my-json-valid is a Node.js library used to validate JSON data against schemas. A flaw in its email validation logic allows attackers to craft malicious input that causes the library to consume excessive CPU resources, resulting in denial of service for any application using this validation function.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the email validation function of is-my-json-valid versions before 2.12.4. The underlying cause is a poorly-constructed regular expression that exhibits catastrophic backtracking when processing specially-crafted email strings. An attacker can send a malicious JSON payload with a crafted email field to any application using the library for validation, causing the regex engine to hang and consume CPU resources, leading to denial of service. No authentication or special privileges are required; the vulnerability is triggered via network-supplied input. The fix is available in version 2.12.4 and later.
Affected products
- mafintosh is-my-json-valid before 2.12.4
Timeline
- 2016-02-23: disclosed
- 2016: patched: Version 2.12.4 released with fix
- 2017-10-24: advisory