Executive brief
ansi-regex is a JavaScript library used to parse and identify ANSI escape codes in text, commonly used in terminal output and logging utilities. The library contains an inefficient regular expression pattern that can be exploited with specially crafted input, causing the parsing function to consume excessive CPU and effectively hang the application. This can be triggered by attackers sending malformed ANSI escape sequences, leading to denial of service and application unavailability.
Technical details
This vulnerability is a Regular Expression Denial of Service (ReDoS) attack caused by catastrophic backtracking in the ansi-regex pattern. The vulnerable sub-patterns [[\\]()#;?]* and (?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)* exhibit exponential time complexity when processing certain invalid ANSI escape code sequences. An attacker can send input like "\u001B[" followed by repeated ";" characters to trigger the backtracking, causing the test() method to hang for extended periods proportional to input length. The vulnerability affects versions 3.0.0-3.0.0, 4.0.0-4.1.0, 5.0.0-5.0.0, and 6.0.0 with patches available in 3.0.1, 4.1.1, 5.0.1, and 6.0.1 respectively.
Affected products
- chalk ansi-regex 3.0.0, 4.0.0–4.1.0, 5.0.0, 6.0.0
Timeline
- 2021-09-20: disclosed: Published on GitHub Advisory Database
- 2021-09-20: patched: Patches released for versions 3.0.1, 4.1.1, 5.0.1, and 6.0.1