Executive brief
code-server is a browser-based code editor that allows developers to access VS Code remotely. The application uses a regular expression to parse terminal color codes, but this regex is susceptible to denial-of-service attacks through specially crafted input. An attacker can send malicious data that causes the regex engine to consume excessive CPU resources, freezing or crashing the service and preventing legitimate users from accessing their development environment.
Technical details
code-server contains a ReDoS (Regular Expression Denial of Service) vulnerability in an ANSI escape code parsing regex located in src/node/util.ts. The vulnerable pattern exhibits catastrophic backtracking when processing specially crafted input, allowing an unauthenticated network attacker to trigger excessive CPU consumption without requiring user interaction. The regex was intended to filter ANSI color codes from terminal output but contained nested quantifiers that could cause exponential matching behavior. The vulnerability was patched in version 3.12.0 by optimizing the regex pattern to avoid backtracking. All prior versions are affected.
Affected products
- Coder code-server before 3.12.0
Timeline
- 2021-09-17: disclosed: Published on NVD
- 2021-09-20: advisory: GitHub Security Advisory GHSA-49x3-8228-3w3m published
- 2021-09-20: patched: Fixed in code-server 3.12.0 via commit ca617df