CVE-2018-3738: protobufjs regular expression denial of service

CVE-2018-3738 · Severity: low · CVSS 3.1 · Published 2018-10-09

protobufjs is a widely-used JavaScript library for parsing and serializing Protocol Buffer messages. Versions before 5.0.3 and 6.8.6 are vulnerable to a denial-of-service attack when processing specially crafted invalid .proto files. An attacker can craft a malicious .proto file that causes the parser's regular expression engine to hang or consume excessive CPU, disrupting applications that depend on this library.

Technologies: protobufjs (npm). Vendors: npm.

Quick answers

Is CVE-2018-3738 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2018-3738 being exploited in the wild.
How severe is CVE-2018-3738?
Low severity, with a CVSS score of 3.1, published 9 October 2018.
Which products and versions are affected?
protobufjs (npm) SEMVER:introduced=6.0.0,fixed=6.8.6.
Is there a fix for CVE-2018-3738?
Yes. protobufjs (npm): upgrade to 6.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-3738 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2018-3738?
Check whether you run protobufjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • protobufjs (npm): upgrade to 6.8.6 or later
    npm install protobufjs@6.8.6

Technical details

This vulnerability is a regular expression denial of service (ReDoS) in protobufjs's .proto file parser. The vulnerable code uses a regular expression in the parse module that exhibits catastrophic backtracking when processing crafted invalid input. The attack is triggered locally via a malicious .proto file (user interaction required—the file must be parsed). Successful exploitation causes CPU exhaustion and service disruption. Patches are available: update to version 5.0.3, 6.8.6, or later to remove the vulnerable regex pattern.

Affected products

  • protobufjs protobufjs before 5.0.3 and 6.0.0 before 6.8.6

Identifiers

  • CVE-2018-3738
  • GHSA-762f-c2wg-m8c8

Timeline

  • 2018-06-07: disclosed
  • 2018-10-09: advisory
  • 2018-10-09: patched: versions 5.0.3 and 6.8.6 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.