Executive brief
steal is a module loader library used to bundle and manage JavaScript dependencies. A flaw in its input parsing allows an attacker to craft malicious input that causes the regular expression engine to consume excessive CPU resources, resulting in service unavailability or application crashes.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the main.js file of steal, specifically in the input variable parsing logic. The vulnerable regex lacks proper anchoring or atomic grouping, allowing catastrophic backtracking when processing specially crafted input. The vulnerability is network-reachable with no authentication required, as the input parsing occurs during module load processing. An attacker can trigger CPU exhaustion by providing a malicious input string, causing denial of service. The vulnerability affects steal versions up to 2.3.0.
Affected products
- stealjs steal up to 2.3.0
Timeline
- 2022-09-15: disclosed: CVE-2022-37260 published
- 2022-09-16: advisory: GHSA-7f3x-2wcx-hww8 published