Executive brief
is-svg is a Node.js library used to validate whether a file or string is an SVG image. An attacker can submit a specially crafted input that causes the library's validation logic to hang indefinitely, leading to denial of service of any application that depends on it for SVG validation.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the is-svg library versions 2.1.0 through 4.2.1. The regex pattern used for SVG validation is susceptible to catastrophic backtracking when processing certain malicious input strings, causing the validation function to consume excessive CPU and hang. The attack requires no authentication and can be triggered remotely by providing a crafted payload to any application consuming the library. An attacker can cause a denial of service by exhausting application resources. The vulnerability was fixed in version 4.2.2 with an improved regex pattern.
Affected products
- is-svg 2.1.0 through 4.2.1
Timeline
- 2021-03-12: disclosed: NVD publication date
- 2021-03-19: patched: Version 4.2.2 released with fix