Executive brief
The printf npm package is a JavaScript library for formatted string output, commonly used in Node.js applications. A Regular Expression Denial of Service (ReDoS) vulnerability in its format string parser allows attackers to craft malicious format strings that cause the application to hang or crash by consuming excessive CPU resources. This can lead to application unavailability and denial of service.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the printf package before version 0.6.1, affecting the format string parsing regex in lib/printf.js. The vulnerable regex pattern has cubic worst-case time complexity when processing specially crafted format strings. An attacker can supply a malicious format string (e.g., "%(0)0" followed by a large number of "0" characters and a special character) as input to printf(), causing the regex engine to consume exponentially increasing CPU cycles. The attack requires no authentication and can be triggered by any code path that accepts user-controlled format strings. The vulnerability was patched in version 0.6.1.
Affected products
- npm printf before 0.6.1
Timeline
- 2021-02-09: disclosed: Vulnerability reported on GitHub issue #31
- 2021-03-12: advisory: CVE-2021-23354 published on NVD
- 2021-03-19: disclosed: GitHub Security Advisory GHSA-xfhp-gmh8-r8v2 published
- 2021-03-15: patched: Fix available in version 0.6.1