Junglewise Threat Intelligence

CVE-2021-28092: is-svg Regular Expression Denial of Service

CVE-2021-28092 · Severity: low · CVSS 3.1 · Published 2021-03-19

Vendors: npm.

Executive brief

is-svg is a Node.js library used to validate whether a file or string is an SVG image. An attacker can submit a specially crafted input that causes the library's validation logic to hang indefinitely, leading to denial of service of any application that depends on it for SVG validation.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the is-svg library versions 2.1.0 through 4.2.1. The regex pattern used for SVG validation is susceptible to catastrophic backtracking when processing certain malicious input strings, causing the validation function to consume excessive CPU and hang. The attack requires no authentication and can be triggered remotely by providing a crafted payload to any application consuming the library. An attacker can cause a denial of service by exhausting application resources. The vulnerability was fixed in version 4.2.2 with an improved regex pattern.

Affected products

  • is-svg 2.1.0 through 4.2.1

Timeline

  • 2021-03-12: disclosed: NVD publication date
  • 2021-03-19: patched: Version 4.2.2 released with fix

References

Related threats