Executive brief
loader-utils is a utility library used by webpack to handle file paths and naming during the web application building process. A vulnerability in how it processes certain strings could allow an attacker to provide a specially crafted input that causes the system to slow down significantly or crash. This could lead to a denial of service, disrupting development pipelines or build servers.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the `interpolateName` function within `interpolateName.js` of the webpack `loader-utils` package. The flaw is rooted in an inefficient regular expression used to parse hash and contenthash placeholders in file names. An attacker can exploit this by providing a maliciously crafted string to the `url` variable, leading to catastrophic backtracking during regex execution. This results in excessive CPU consumption, potentially causing the process to hang or crash. The issue has been addressed by updating the regular expression to prevent such backtracking in versions 1.4.2, 2.0.4, and 3.2.1.
Affected products
- webpack loader-utils < 1.4.2, >= 2.0.0 < 2.0.4, >= 3.0.0 < 3.2.1
Timeline
- 2022-10-05: disclosed: Issue reported on GitHub
- 2022-10-14: advisory: NVD and GitHub advisories published
- 2022-10-14: patched: Fixes released in multiple versions
References
- https://github.com/webpack/loader-utils/issues/213
- https://github.com/webpack/loader-utils/issues/216
- https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa
- https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb
- https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1
- https://github.com/webpack/loader-utils