Executive brief
js-bson is a JavaScript library used to serialize and deserialize data for MongoDB. A flaw in the Decimal128 number parser allows attackers to cause a denial of service by providing a long malicious string that triggers excessive regex backtracking, consuming CPU and freezing the application.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the Decimal128.fromString() function in lib/bson/decimal128.js. When parsing an untrusted input string, a catastrophic backtracking regex allows an attacker to cause exponential CPU consumption by submitting a carefully crafted long string. The vulnerability affects versions 0.5.0 through 1.0.4. An attacker with network access can trigger this by sending a malicious Decimal128 value to any application using affected js-bson versions. The fix, available in version 1.0.5, adds a string length guard that rejects inputs exceeding 7000 characters.
Affected products
- MongoDB js-bson 0.5.0 to 1.0.4
Timeline
- 2018-09-17: disclosed
- 2018-09-17: patched: Fixed in version 1.0.5