Executive brief
Locutus is a library that provides JavaScript implementations of standard functions from other programming languages. A vulnerability in its Gopher protocol parsing function allows an attacker to send specially crafted data that causes the system to freeze or become unresponsive. This can lead to a service outage, preventing legitimate users from accessing the application.
Technical details
The locutus package before version 2.0.15 is vulnerable to a Regular Expression Denial of Service (ReDoS) within the `gopher_parsedir` function. The vulnerability is caused by an inefficient regular expression (`entryPattern`) that uses nested quantifiers and non-greedy matching, leading to catastrophic backtracking when processing certain malformed input strings containing many tab characters. An unauthenticated remote attacker can exploit this by providing a crafted string to the function, causing the JavaScript engine to consume excessive CPU cycles. This results in a denial of service (DoS) condition. The issue was fixed in version 2.0.15 by optimizing the regular expression to use negated character classes.
Affected products
- locutusjs locutus < 2.0.15
Timeline
- 2021-04-05: disclosed: Vulnerability disclosed to vendor
- 2021-05-27: patched: Fix merged into master branch and released in version 2.0.15
- 2021-06-08: advisory: NVD published CVE-2021-23392