Is CVE-2021-21252 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-21252 being exploited in the wild.

How severe is CVE-2021-21252?

Low severity, with a CVSS score of 3.1, published 13 January 2021.

Which products and versions are affected?

jquery-validation (npm) SEMVER:introduced=0,fixed=1.19.3.

Is there a fix for CVE-2021-21252?

Yes. jquery-validation (npm): upgrade to 1.19.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-21252 attacked?

It is attacked over the network.

Am I affected by CVE-2021-21252?

Check whether you run jquery-validation (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-21252: jquery-validation regular expression denial of service

CVE-2021-21252 · Severity: low · CVSS 3.1 · Published 2021-01-13

jQuery Validation is a widely-used client-side form validation library integrated into many websites and web applications. An attacker can craft malicious input that triggers catastrophic backtracking in the library's regular expressions, causing the application to become unresponsive or crash. This can lead to denial of service against users attempting to validate forms, disrupting normal application usage.

Technologies: jquery-validation (npm). Vendors: npm.

Quick answers

Is CVE-2021-21252 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-21252 being exploited in the wild.
How severe is CVE-2021-21252?: Low severity, with a CVSS score of 3.1, published 13 January 2021.
Which products and versions are affected?: jquery-validation (npm) SEMVER:introduced=0,fixed=1.19.3.
Is there a fix for CVE-2021-21252?: Yes. jquery-validation (npm): upgrade to 1.19.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-21252 attacked?: It is attacked over the network.
Am I affected by CVE-2021-21252?: Check whether you run jquery-validation (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jquery-validation (npm): upgrade to 1.19.3 or later
```
npm install jquery-validation@1.19.3
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting one or more regex patterns in jquery-validation. An attacker can supply crafted input that causes regex engines to experience catastrophic backtracking, leading to CPU exhaustion and application hang. The attack vector is network-based with no authentication or user interaction required beyond normal form submission. By submitting malicious data to a form protected by vulnerable validation rules, an attacker can trigger the DoS condition. The vulnerability was fixed in version 1.19.3; users should upgrade immediately.

Affected products

jquery-validation jquery-validation before 1.19.3

Identifiers

CVE-2021-21252
GHSA-jxwx-85vp-gvwm

Timeline

2021-01-13: disclosed
2021-01-13: patched: Version 1.19.3 released

References

https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.