Quick answers
- Is CVE-2022-37259 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-37259 being exploited in the wild.
- How severe is CVE-2022-37259?
- Low severity, with a CVSS score of 3.1, published 21 September 2022.
- Which products and versions are affected?
- steal (npm) SEMVER:introduced=0,last_affected=2.3.0.
- Is there a fix for CVE-2022-37259?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2022-37259 attacked?
- It is attacked over the network.
- Am I affected by CVE-2022-37259?
- Check whether you run steal (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A ReDoS (Regular Expression Denial of Service) vulnerability exists in the steal module version 2.3.0 and earlier, specifically in the babel.js component's regex pattern used to process string variables. The vulnerability arises from catastrophic backtracking in an inefficiently designed regular expression (CWE-1333) that processes untrusted input strings. An attacker can supply a malicious input string that causes the regex engine to perform exponential backtracking, consuming significant CPU resources and causing the application to hang or become unresponsive. No authentication is required; the attack vector is network-based if the application processes external input. Patches are expected to be available; users should upgrade to a version after 2.3.0.
Affected products
- stealjs steal 2.3.0 and earlier
Identifiers
- CVE-2022-37259
- GHSA-rgqx-226f-2xp4
Timeline
- 2022-09-20: disclosed: NVD publication date
- 2022-09-21: advisory: GitHub Security Advisory published