Executive brief
scss-tokenizer is a JavaScript library used to parse SCSS (Sass stylesheets) in web development and build tools. A flaw in the library's regular expression parsing can allow an attacker to craft malicious stylesheet input that consumes excessive CPU resources, causing the application to become unresponsive or crash. This impacts any web application or build pipeline that processes untrusted SCSS input.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) vulnerability in the loadAnnotation() function of scss-tokenizer, caused by insecure regex patterns (CWE-1333). The vulnerable function uses a poorly-crafted regular expression that exhibits catastrophic backtracking when processing specially-crafted input strings. The attack is network-reachable without authentication, as it can be triggered by supplying malicious SCSS content to any application using the library. An attacker can achieve denial of service by causing high CPU consumption. The vulnerability affects all versions prior to 0.4.3, which contains the fix.
Affected products
- npm scss-tokenizer <0.4.3
Timeline
- 2022-07-02: disclosed: Advisory published
- 2022-07-01: patched: Fix released in version 0.4.3