Junglewise Threat Intelligence

CVE-2016-4055: Moment.js ReDoS in duration function

CVE-2016-4055 · Severity: medium · CVSS 6.5 · Published 2017-01-23

Technologies: Tenable Nessus, Moment.js project Moment. Vendors: Oracle, Tenable, Momentjs.

Executive brief

The Moment.js library, a popular tool for parsing and formatting dates in Node.js applications, is vulnerable to a denial-of-service attack. By providing a specially crafted long string to the library's duration function, an attacker can cause the application to consume excessive CPU resources. This can lead to the application becoming unresponsive, potentially disrupting business operations and service availability.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the duration function of the Moment.js library prior to version 2.11.2. The root cause is an inefficient regular expression used to parse duration strings, which exhibits polynomial or exponential backtracking when processing specifically crafted long input strings. A remote attacker can exploit this by submitting a malicious string to any application endpoint that passes user input to the affected function. Successful exploitation results in high CPU utilization, blocking the Node.js event loop and causing a denial of service. The issue is resolved in version 2.11.2.

Affected products

  • Moment.js project moment < 2.11.2

Timeline

  • 2016-04-20: disclosed: Vulnerability disclosed via OSS-security mailing list
  • 2017-01-23: advisory: NVD advisory published

References

Related threats