Executive brief
date-and-time is a popular Node.js library for parsing and manipulating date and time values. A regular expression used in date parsing contains a flaw that allows an attacker to craft malicious input strings that consume excessive CPU resources, causing the application to become unresponsive or crash. This denial-of-service attack requires no authentication and can be triggered remotely by any user who can provide input to the parsing functions.
Technical details
This vulnerability is a regular expression denial of service (ReDoS) attack in the date-and-time npm package prior to version 0.14.2. The vulnerable regex is used in date/time parsing logic and exhibits catastrophic backtracking when processing specially crafted input strings. An attacker can send malicious input to the parsing functions to trigger exponential regex matching behavior, consuming CPU and causing denial of service. The attack vector is network-accessible and requires no authentication or user interaction. The vulnerability is fixed in version 0.14.2, which replaces or optimizes the problematic regular expression.
Affected products
- knowledgecode date-and-time before 0.14.2
Timeline
- 2020-12-24: disclosed
- 2020-12-24: patched: version 0.14.2 released