Executive brief
uri-template-lite is an npm package that provides URI template expansion functionality used by applications to dynamically construct URLs. An attacker who can supply arbitrary input to the URI.expand method can trigger excessive processing by exploiting a vulnerable regular expression, causing the application to hang or become unresponsive.
Technical details
The vulnerability is an exponential ReDoS (Regular Expression Denial of Service) triggered by a malicious regular expression pattern in the uri-template-lite npm package. The vulnerable component is the URI.expand method, which fails to properly validate input before processing it against a regex that exhibits catastrophic backtracking behavior. An attacker can supply specially crafted strings (such as "{00000000000000000000000000000") to cause the regex engine to consume excessive CPU time. This is a network-reachable vulnerability with no authentication required—any application that accepts user input and passes it to URI.expand is affected. The vulnerability was patched in version 22.9.0 and affects all previous versions.
Affected products
- LiteJS uri-template-lite all versions before 22.9.0
Timeline
- 2022-08-25: disclosed
- 2022-09-01: patched: Fixed in version 22.9.0