Junglewise Threat Intelligence

CVE-2017-20165: debug inefficient regular expression complexity

CVE-2017-20165 · Severity: low · CVSS 3.1 · Published 2023-01-09

Executive brief

The debug library is a widely-used Node.js logging utility. A vulnerability in its string-processing function can be exploited to cause a denial-of-service by triggering catastrophic backtracking in a regular expression, causing the application to hang or consume excessive CPU.

Technical details

This vulnerability (CWE-1333) involves an inefficient regular expression in the useColors function of src/node.js that is susceptible to Regular Expression Denial of Service (ReDoS) attacks. An attacker can supply a specially-crafted string argument that causes the regex engine to experience catastrophic backtracking, resulting in severe performance degradation or denial of service. The vulnerability affects all versions prior to 2.6.9 and versions 3.0.x (fixed in 3.1.0). No authentication or special privileges are required to trigger the issue; an attacker only needs to control the input passed to the affected function. The fix involves replacing the vulnerable regex pattern with a simpler, more efficient implementation.

Affected products

  • debug-js debug prior to 2.6.9 and 3.0.x versions (fixed in 3.1.0)

Timeline

  • 2023-01-09: disclosed
  • 2017-09-21: patched: Fix merged in PR #504; backported to 2.6.9 and released as 3.1.0

References