Executive brief
Taro is a cross-platform development framework that provides helper utilities for building applications across multiple platforms and frameworks. A flaw in its URL validation logic allows attackers to send specially crafted input strings that cause the application to hang or become unresponsive by exhausting CPU resources. This can disrupt services that use Taro, especially those processing untrusted URL inputs from users or external sources.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) issue in the URL validation regex pattern within the @tarojs/helper package. The inefficient regex exhibits catastrophic backtracking when processing certain malformed input strings, causing the regex engine to enter exponential time complexity (CWE-1333). The attack is network-reachable and requires no authentication or user interaction—any code path that validates user-supplied URLs using the vulnerable regex is exploitable. An attacker can trigger excessive CPU consumption by providing a crafted URL input, resulting in application hang or slowdown. The fix was implemented in version 3.3.9, which optimizes the regex pattern to eliminate backtracking. Patch availability: Fixed in @tarojs/helper 3.3.9 and later.
Affected products
- NervJS @tarojs/helper < 3.3.9
Timeline
- 2021-09-20: disclosed
- 2021-09-20: patched: Fixed in version 3.3.9