Executive brief
nth-check is a JavaScript library that parses CSS nth-child selectors. A malicious attacker can provide specially crafted CSS selectors that trigger excessive processing in the library's regex pattern, causing the application to hang or become unresponsive (denial of service).
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability in the nth-check library caused by inefficient regex pattern complexity (CWE-1333). The vulnerable regex sub-pattern \s*(?:([+-]?)\s*(\d+))? contains quantified overlapping adjacency that allows an attacker to provide input with excessive whitespace, triggering catastrophic backtracking. An attacker can craft a malicious CSS nth-check string and pass it to nthCheck.parse() without any authentication or special privileges, causing the parsing operation to consume significant CPU and hang the application. The vulnerability was fixed in version 2.0.1 by replacing the vulnerable regex with a hand-rolled parser.
Affected products
- fb55 nth-check before 2.0.1
Timeline
- 2021-09-17: disclosed
- 2021-09-20: advisory
- 2021-09-20: patched: Fixed in version 2.0.1