Executive brief
jquery-validation is a popular JavaScript library that validates form input. An attacker who can supply arbitrary input to the url2 validation method can trigger an exponential denial-of-service condition, causing the application to become unresponsive and degrade performance.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the url2 method of jquery-validation, affecting the regex pattern used for URL validation (CWE-1333). The vulnerable regex exhibits catastrophic backtracking when an attacker supplies a maliciously crafted input string designed to trigger the exponential nature of the pattern. The attack requires the ability to provide arbitrary input to the url2 validator, which is feasible in any web form where user input is validated. An attacker can cause the JavaScript engine to consume excessive CPU and block execution, leading to denial of service. The vulnerability was fixed in version 1.19.4 with an updated regex pattern.
Affected products
- jquery-validation jquery-validation before 1.19.4
Timeline
- 2022-06-02: disclosed
- 2022-05-19: patched: Fix merged in PR #2428
- 2022-06-03: advisory