Is CVE-2021-3810 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-3810 being exploited in the wild.

How severe is CVE-2021-3810?

Low severity, with a CVSS score of 3, published 20 September 2021.

Which products and versions are affected?

code-server (npm) SEMVER:introduced=0,fixed=3.12.0.

Is there a fix for CVE-2021-3810?

Yes. code-server (npm): upgrade to 3.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-3810 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2021-3810?

Check whether you run code-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-3810: code-server regular expression denial of service

CVE-2021-3810 · Severity: low · CVSS 3 · Published 2021-09-20

code-server is a browser-based code editor that allows developers to access VS Code remotely. The application uses a regular expression to parse terminal color codes, but this regex is susceptible to denial-of-service attacks through specially crafted input. An attacker can send malicious data that causes the regex engine to consume excessive CPU resources, freezing or crashing the service and preventing legitimate users from accessing their development environment.

Technologies: code-server (npm). Vendors: npm.

Quick answers

Is CVE-2021-3810 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-3810 being exploited in the wild.
How severe is CVE-2021-3810?: Low severity, with a CVSS score of 3, published 20 September 2021.
Which products and versions are affected?: code-server (npm) SEMVER:introduced=0,fixed=3.12.0.
Is there a fix for CVE-2021-3810?: Yes. code-server (npm): upgrade to 3.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-3810 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2021-3810?: Check whether you run code-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code-server (npm): upgrade to 3.12.0 or later
```
npm install code-server@3.12.0
```

Technical details

code-server contains a ReDoS (Regular Expression Denial of Service) vulnerability in an ANSI escape code parsing regex located in src/node/util.ts. The vulnerable pattern exhibits catastrophic backtracking when processing specially crafted input, allowing an unauthenticated network attacker to trigger excessive CPU consumption without requiring user interaction. The regex was intended to filter ANSI color codes from terminal output but contained nested quantifiers that could cause exponential matching behavior. The vulnerability was patched in version 3.12.0 by optimizing the regex pattern to avoid backtracking. All prior versions are affected.

Affected products

Coder code-server before 3.12.0

Identifiers

CVE-2021-3810
GHSA-49x3-8228-3w3m

Timeline

2021-09-17: disclosed: Published on NVD
2021-09-20: advisory: GitHub Security Advisory GHSA-49x3-8228-3w3m published
2021-09-20: patched: Fixed in code-server 3.12.0 via commit ca617df

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.