Executive brief
is_js is a JavaScript validation library used to check data types and formats in web applications. The library contains an inefficient regular expression used for URL validation that can be exploited to cause excessive CPU consumption and application hangs when processing malicious input strings, potentially disrupting service availability.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in is_js versions 0.9.0 and earlier. The library uses a vulnerable regex pattern (copied from a gist) to validate URLs that exhibits catastrophic backtracking when given malicious input, allowing an attacker to cause the regex engine to hang. The attack requires network-reachable input validation logic with no authentication prerequisites. An attacker can trigger excessive CPU consumption leading to denial of service. No patch has been released; the issue remains unresolved in the repository.
Affected products
- is.js 0.9.0 and prior
Timeline
- 2023-07-06: disclosed: GitHub Security Advisory published
- 2022-12-22: other: NVD entry published
- 2020-11-30: other: Vulnerability initially reported to maintainers