Executive brief
rgb2hex is a JavaScript library that converts RGB color values to hexadecimal format. The library contained an inefficient regular expression pattern that could be exploited to cause a Denial of Service (ReDoS attack), making the application unresponsive when processing specially crafted input. This vulnerability affects applications that accept user-supplied color values.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) issue caused by an inefficient regular expression pattern used to parse RGB color input. The vulnerable regex exhibited excessive backtracking when processing certain malformed input strings, allowing attackers to craft inputs that would cause the regex engine to consume significant CPU resources. No authentication is required; an attacker can trigger this remotely by sending malicious input to any application using the vulnerable version. The fix was applied in version 0.1.6, which optimized the regex pattern to eliminate catastrophic backtracking.
Affected products
- Christian Bromann rgb2hex up to 0.1.5
Timeline
- 2022-12-31: disclosed
- 2018-07-05: patched: Fix committed in v0.1.6