Executive brief
The cumulative-distribution-function npm library is susceptible to infinite loop attacks when processing string data instead of numeric data. An attacker can supply malformed input (e.g., an array of numeric strings like ["1","2","3"] instead of [1,2,3]) to cause a Node.js server to hang indefinitely or a browser to freeze, effectively denying service to legitimate users. This is particularly dangerous in server environments where a single malicious request can impact all users of that application.
Technical details
The vulnerability is a classic improper input validation flaw (CWE-20) combined with an infinite loop condition (CWE-835) in the cumulative distribution function (CDF) evaluation code. The library fails to validate that input data is numeric type (Array[number]) before processing, instead assuming numeric data as documented. When string data is supplied (e.g., ["1","2","3"]), the comparison logic in the while loop never reaches its exit condition, causing infinite execution. The attack requires no authentication and is network-reachable if the vulnerable library is exposed through a web service. An attacker can trigger a denial-of-service by sending a single request with string-formatted data, causing the entire application process to hang. The vulnerability was patched in version 2.0.0, which adds explicit type checking and throws a TypeError for invalid input data.
Affected products
- DrPaulBrewer cumulative-distribution-function <=1.0.3
Timeline
- 2021-04-30: disclosed: Vulnerability disclosed on GitHub advisory GHSA-58qp-5328-v7mh
- 2021-04-29: patched: Patch released in version 2.0.0
References
- https://github.com/DrPaulBrewer/cumulative-distribution-function/security/advisories/GHSA-58qp-5328-v7mh
- https://github.com/DrPaulBrewer/cumulative-distribution-function/issues/7
- https://github.com/DrPaulBrewer/cumulative-distribution-function/pull/8
- https://www.npmjs.com/package/cumulative-distribution-function