Quick answers
- Is CVE-2021-32723 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-32723 being exploited in the wild.
- How severe is CVE-2021-32723?
- Low severity, with a CVSS score of 3.1, published 28 June 2021.
- Which products and versions are affected?
- prismjs (npm) SEMVER:introduced=0,fixed=1.24.0; PrismJS Prism <1.24.0.
- Is there a fix for CVE-2021-32723?
- Yes. prismjs (npm): upgrade to 1.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-32723 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-32723?
- Check whether you run prismjs (npm) or PrismJS Prism at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- prismjs (npm): upgrade to 1.24.0 or later
npm install prismjs@1.24.0
Technical details
This is a regular expression denial of service (ReDoS) vulnerability in the syntax highlighting engine of Prism versions before 1.24.0. The vulnerable patterns are in the ASCIIDoc and ERB language definitions, which contain inefficient regex patterns prone to catastrophic backtracking when processing untrusted input. When an attacker provides a carefully crafted string to be highlighted, the regex engine enters a state of exponential backtracking, consuming CPU resources for an extended period. The vulnerability requires the attacker to control the text being highlighted, which is a realistic scenario when syntax highlighting user-submitted code. The issue has been patched in Prism v1.24.0.
Affected products
- PrismJS Prism <1.24.0
Identifiers
- CVE-2021-32723
- GHSA-gj77-59wh-66hg
Timeline
- 2021-06-28: disclosed
- 2021-06-28: patched: Fixed in v1.24.0