Executive brief
url-regex is a popular JavaScript library used to validate and extract URLs from strings. A carefully crafted input string can cause the library's regular expression engine to consume 100% CPU and hang indefinitely, leading to application unavailability. This vulnerability affects all versions and can be exploited remotely without authentication.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by catastrophic backtracking in the library's URL validation regex pattern. When processing a specially crafted long string (e.g., a string of digits and dots that resembles but is not a valid URL), the regex engine enters catastrophic backtracking, consuming all available CPU cycles and causing the application to hang. No authentication is required and the attack is network-accessible if the application exposes URL validation functionality. An attacker can achieve denial of service by providing a malicious input string to the String.test() method. All versions up to and including 5.0.0 are affected; a fix is available as a separate package (url-regex-safe) but the original project has not released a patched version.
Affected products
- Kevin Mårtensson url-regex all versions up to 5.0.0
Timeline
- 2020-04-26: disclosed
- 2020-06-22: advisory
- 2020-08-15: other: url-regex-safe package released as alternative with fix