Executive brief
brace-expansion is a popular Node.js library that expands strings with brace patterns (e.g., converting "{a,b,c}" into "a b c"). The library contains a regular expression vulnerability that allows an attacker to cause a denial of service by providing a specially crafted input string, consuming excessive CPU and freezing applications that use the library. This impacts any Node.js application or tool that depends on brace-expansion.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) condition in the brace-expansion library's pattern matching logic. The vulnerable regular expression exhibits catastrophic backtracking when processing malformed input strings with many consecutive commas and newlines. The attack is triggered remotely through untrusted input to the expand() function with no authentication required. An attacker can cause the affected process to hang indefinitely, achieving a denial of service condition. The vulnerability was fixed in version 1.1.7 via improved regex pattern handling.
Affected products
- Julian Gruber brace-expansion before 1.1.7
Timeline
- 2017-03-02: disclosed
- 2018-01-29: patched