Executive brief
jsx-slack is a JavaScript library used to build Slack messaging interfaces from JSX code. A regular expression denial of service (ReDoS) vulnerability allows an attacker to craft malicious blockquote content that triggers excessive CPU consumption during character escaping, potentially causing the application to slow down or become unresponsive. This could disrupt Slack message generation for affected applications or services.
Technical details
The vulnerability exists in jsx-slack's internal regular expression used for escaping characters within blockquote tags. The regex exhibits catastrophic backtracking when processing large numbers of nested JSX elements, leading to exponential time complexity (CWE-1333, CWE-400). An attacker who can control content placed inside blockquote tags can trigger this behavior—for example, by submitting a blockquote with 40+ nested paragraph elements. The attack requires network access and no authentication or user interaction. Version 4.5.1 attempted a workaround that worked for ASCII content but remained vulnerable to multibyte characters. Version 4.5.2 fixes the issue by updating the regular expressions to prevent catastrophic backtracking.
Affected products
- jsx-slack jsx-slack <4.5.2
Timeline
- 2021-12-17: disclosed
- 2021-12-17: patched: Version 4.5.2 released with fixes for catastrophic backtracking