Executive brief
three.js is a popular JavaScript 3D graphics library used in web applications to render interactive 3D content. A vulnerability in the Color parsing function allows an attacker to cause a denial of service by providing specially crafted RGB or HSL color strings that trigger catastrophic backtracking in the regex engine, causing the application to hang or crash.
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability in the Color.js module of three.js (before version 0.125.0). The vulnerable regex pattern `/^((?:rgb|hsl)a?)\(\s*([^\)]*)\)/` at line 166 uses a problematic `[^\)]*` quantifier that can cause catastrophic backtracking when processing malformed RGB/HSL color strings with excessive whitespace. The vulnerability is triggered when the Color constructor is called with a crafted string like `rgb(` followed by tens of thousands of spaces, causing the regex engine to exhaust CPU resources. No authentication or user interaction is required; any code path that instantiates a Color object with untrusted input is vulnerable. The patch, available in version 0.125.0 and later, replaces the problematic quantifier with `[^\)\s]*` to prevent the backtracking.
Affected products
- three.js three before 0.125.0
Timeline
- 2021-01-23: disclosed: Vulnerability reported on GitHub
- 2021-02-24: patched: Fixed in three.js version 0.125.0
- 2021-03-01: advisory: GHSA advisory published