Junglewise Threat Intelligence

CVE-2018-13863: MongoDB js-bson regular expression denial of service

CVE-2018-13863 · Severity: low · CVSS 3 · Published 2018-09-17

Technologies: bson (npm). Vendors: MongoDB, npm.

Executive brief

js-bson is a JavaScript library used to serialize and deserialize data for MongoDB. A flaw in the Decimal128 number parser allows attackers to cause a denial of service by providing a long malicious string that triggers excessive regex backtracking, consuming CPU and freezing the application.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the Decimal128.fromString() function in lib/bson/decimal128.js. When parsing an untrusted input string, a catastrophic backtracking regex allows an attacker to cause exponential CPU consumption by submitting a carefully crafted long string. The vulnerability affects versions 0.5.0 through 1.0.4. An attacker with network access can trigger this by sending a malicious Decimal128 value to any application using affected js-bson versions. The fix, available in version 1.0.5, adds a string length guard that rejects inputs exceeding 7000 characters.

Affected products

  • MongoDB js-bson 0.5.0 to 1.0.4

Timeline

  • 2018-09-17: disclosed
  • 2018-09-17: patched: Fixed in version 1.0.5

References

Related threats