Junglewise Threat Intelligence

CVE-2021-23353: jsPDF ReDoS in addImage function

CVE-2021-23353 · Severity: low · CVSS 3.1 · Published 2021-03-12

Technologies: Jspdf. Vendors: npm.

Executive brief

jsPDF is a popular JavaScript library used to generate PDF documents in web applications. The library contains a regular expression parsing flaw in its addImage function that can be exploited to cause a denial of service by sending specially crafted input. An attacker can force the application to spend excessive CPU time processing the malicious input, leading to service unavailability or slow performance for legitimate users.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the addImage function within jsPDF versions prior to 2.3.1. The vulnerable regex pattern uses nested quantifiers that exhibit catastrophic backtracking behavior when processing certain input strings. Specifically, the pattern `/^data:(\w*\/\w*);*charset=[\\w=-]*;*$/` fails to efficiently handle strings with repetitive characters followed by a non-matching character, causing the regex engine to explore an exponentially increasing number of backtracking paths. An attacker can provide a specially crafted data URL to the addImage function that triggers this condition, causing the JavaScript engine to consume CPU resources until completion. The attack requires no authentication or user interaction and is exploitable over the network if the vulnerable code processes untrusted input. The vulnerability was patched in version 2.3.1 with a corrected regex pattern.

Affected products

  • jsPDF jsPDF before 2.3.1

Timeline

  • 2021-02-12: disclosed
  • 2021-03-09: advisory: NVD published the CVE
  • 2021-03-12: patched: Fixed in jsPDF 2.3.1

References

Related threats