Executive brief
Remarkable is a popular Markdown parser library used to convert Markdown text into HTML. A flaw in its HTML tag parsing logic allows an attacker to cause the parser to hang indefinitely by submitting specially crafted input containing a malformed CDATA section, resulting in service unavailability for applications that depend on this library.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) condition in lib/common/html_re.js affecting versions prior to 1.7.2. The vulnerable regex pattern used to parse CDATA sections exhibits catastrophic backtracking when processing malformed input with repeating characters in the CDATA section. An attacker can trigger indefinite CPU consumption by providing input such as `<![CDATA[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]]>`, causing the application to hang. The attack requires only network access to an application that processes untrusted Markdown via Remarkable; no authentication or special privileges are needed. The fix was released in version 1.7.2.
Affected products
- remarkable remarkable < 1.7.2
Timeline
- 2019-05-13: disclosed
- 2019-06-06: advisory
- 2019: patched: Fix released in version 1.7.2