Executive brief
The string.js library (a popular npm package for string manipulation) contains a regular expression vulnerability in its underscore() and unescapeHTML() methods. When an application passes untrusted user input to these methods, an attacker can craft specific inputs that cause excessive CPU consumption, making the application unresponsive and degrading service availability.
Technical details
This is a regular expression denial of service (ReDoS) vulnerability in the string.js npm package, affecting version 3.3.3 and earlier. The underscore() and unescapeHTML() methods contain regular expressions that exhibit catastrophic backtracking when processing specially crafted malicious input. The vulnerability is exploitable via network if user input is passed unsanitized to these methods, requiring no authentication or user interaction. A successful exploit causes CPU exhaustion on the affected application. At publication, no official patch was available; the recommendation is to avoid passing user input to these methods, or to apply an unmerged user-submitted patch from Pull Request #217.
Affected products
- string.js string <=3.3.3
Timeline
- 2018-07-24: disclosed