Executive brief
timespan is a JavaScript library for parsing and manipulating time duration strings. The library contains inefficient regular expressions that can be exploited to cause severe delays in processing, blocking application functionality when an attacker sends specially crafted date strings. An attacker with the ability to submit input to an application using timespan can slow or freeze the event loop for several seconds, degrading service availability.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) affecting multiple date parsing regular expressions in the timespan library. The vulnerable regexes lack anchors and contain repetition patterns that can be exploited through catastrophic backtracking. An attacker can provide a malicious input string (e.g., 50,000 characters) that causes the regex engine to spend around 10 seconds performing pattern matching, blocking the JavaScript event loop. No direct patch has been released; mitigation requires switching to an alternative library, implementing strict input validation, or limiting input length to approximately 150 characters.
Affected products
- indexzero timespan 0 through 2.3.0
Timeline
- 2017-09-07: disclosed
- 2018-08-29: advisory