Is CVE-2021-23353 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-23353 being exploited in the wild.

How severe is CVE-2021-23353?

Low severity, with a CVSS score of 3.1, published 12 March 2021.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=2.3.1.

Is there a fix for CVE-2021-23353?

Yes. jspdf (npm): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-23353 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-23353?

Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-23353: jsPDF ReDoS in addImage function

CVE-2021-23353 · Severity: low · CVSS 3.1 · Published 2021-03-12

jsPDF is a popular JavaScript library used to generate PDF documents in web applications. The library contains a regular expression parsing flaw in its addImage function that can be exploited to cause a denial of service by sending specially crafted input. An attacker can force the application to spend excessive CPU time processing the malicious input, leading to service unavailability or slow performance for legitimate users.

Technologies: jspdf (npm). Vendors: npm.

Quick answers

Is CVE-2021-23353 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-23353 being exploited in the wild.
How severe is CVE-2021-23353?: Low severity, with a CVSS score of 3.1, published 12 March 2021.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=2.3.1.
Is there a fix for CVE-2021-23353?: Yes. jspdf (npm): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-23353 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-23353?: Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 2.3.1 or later
```
npm install jspdf@2.3.1
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the addImage function within jsPDF versions prior to 2.3.1. The vulnerable regex pattern uses nested quantifiers that exhibit catastrophic backtracking behavior when processing certain input strings. Specifically, the pattern `/^data:(\w*\/\w*);*charset=[\\w=-]*;*$/` fails to efficiently handle strings with repetitive characters followed by a non-matching character, causing the regex engine to explore an exponentially increasing number of backtracking paths. An attacker can provide a specially crafted data URL to the addImage function that triggers this condition, causing the JavaScript engine to consume CPU resources until completion. The attack requires no authentication or user interaction and is exploitable over the network if the vulnerable code processes untrusted input. The vulnerability was patched in version 2.3.1 with a corrected regex pattern.

Affected products

jsPDF jsPDF before 2.3.1

Identifiers

CVE-2021-23353
GHSA-57f3-gghm-9mhc

Timeline

2021-02-12: disclosed
2021-03-09: advisory: NVD published the CVE
2021-03-12: patched: Fixed in jsPDF 2.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.