Executive brief
The sshpk library, a tool used for parsing and manipulating SSH keys in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted, invalid public key that causes the application to consume excessive CPU resources while trying to process it. This can lead to the application becoming unresponsive, potentially disrupting services that rely on SSH key authentication or management.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the sshpk library's SSH public key parsing logic. The vulnerability is rooted in the use of inefficient regular expressions (specifically SSHKEY_RE and SSHKEY_RE2 in lib/formats/ssh.js) that exhibit polynomial or exponential backtracking when processing certain malformed input strings. An unauthenticated remote attacker can exploit this by submitting a specially crafted, invalid public key to an application using sshpk for key validation or storage. This results in catastrophic backtracking, leading to 100% CPU utilization and a denial-of-service condition. The issue is fixed in versions 1.13.2 and 1.14.1.
Affected products
- Joyent sshpk < 1.13.2, < 1.14.1
Timeline
- 2018-06-06: advisory: NVD published CVE-2018-3737
- 2018-08-15: disclosed: GitHub Advisory published