Junglewise Threat Intelligence

CVE-2021-32723: PrismJS Prism regular expression denial of service

CVE-2021-32723 · Severity: low · CVSS 3.1 · Published 2021-06-28

Technologies: PrismJS Prism, prismjs (npm). Vendors: PrismJS, npm.

Executive brief

Prism is a popular syntax highlighting library used to format code snippets on websites. A regular expression flaw allows attackers to craft malicious input strings that consume excessive CPU time when processed for syntax highlighting, potentially causing service outages. This affects only the ASCIIDoc and ERB language definitions; other languages are safe.

Technical details

This is a regular expression denial of service (ReDoS) vulnerability in the syntax highlighting engine of Prism versions before 1.24.0. The vulnerable patterns are in the ASCIIDoc and ERB language definitions, which contain inefficient regex patterns prone to catastrophic backtracking when processing untrusted input. When an attacker provides a carefully crafted string to be highlighted, the regex engine enters a state of exponential backtracking, consuming CPU resources for an extended period. The vulnerability requires the attacker to control the text being highlighted, which is a realistic scenario when syntax highlighting user-submitted code. The issue has been patched in Prism v1.24.0.

Affected products

  • PrismJS Prism <1.24.0

Timeline

  • 2021-06-28: disclosed
  • 2021-06-28: patched: Fixed in v1.24.0

References

Related threats