Executive brief
steal is a JavaScript module loader and builder used in web applications. A regular expression denial of service (ReDoS) vulnerability in the babel.js component can be exploited by providing specially crafted input strings, causing the application to consume excessive CPU and become unresponsive. This could lead to service availability issues in production environments using affected versions.
Technical details
A ReDoS (Regular Expression Denial of Service) vulnerability exists in the steal module version 2.3.0 and earlier, specifically in the babel.js component's regex pattern used to process string variables. The vulnerability arises from catastrophic backtracking in an inefficiently designed regular expression (CWE-1333) that processes untrusted input strings. An attacker can supply a malicious input string that causes the regex engine to perform exponential backtracking, consuming significant CPU resources and causing the application to hang or become unresponsive. No authentication is required; the attack vector is network-based if the application processes external input. Patches are expected to be available; users should upgrade to a version after 2.3.0.
Affected products
- stealjs steal 2.3.0 and earlier
Timeline
- 2022-09-20: disclosed: NVD publication date
- 2022-09-21: advisory: GitHub Security Advisory published