Executive brief
ssri is a Node.js library used to parse and verify Subresource Integrity (SRI) hashes, which ensure that web resources have not been tampered with. A vulnerability in this library allows an attacker to cause a denial-of-service (DoS) condition, potentially crashing or slowing down the application. This occurs when the library processes specifically crafted, extremely long hash strings while running in 'strict mode'.
Technical details
The ssri module for Node.js is vulnerable to a Regular Expression Denial of Service (ReDoS) within its strict mode functionality. The root cause is an inefficient regular expression in index.js used to validate SRI strings. An attacker can exploit this by providing an exceptionally long base64 hash string to the library when the 'opts.strict' option is enabled. This causes the regex engine to consume excessive CPU resources, leading to a denial of service. The issue is fixed in version 5.2.2 by optimizing the regular expression.
Affected products
- zkat ssri < 5.2.2
Timeline
- 2018-02-14: patched: Fix committed in GitHub repository.
- 2018-03-03: disclosed: NVD publication date.
- 2018-03-07: advisory: GitHub Advisory published.