Junglewise Threat Intelligence

CVE-2024-1899: Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

CVE-2024-1899 · Severity: medium · CVSS 5.3 · Published 2024-02-26

Technologies: showdown (npm). Vendors: npm.

Executive brief

Showdown is a JavaScript library that converts Markdown to HTML and vice versa, commonly used in web applications and content management systems. A regular expression denial of service (ReDoS) vulnerability in its link/anchor parsing allows an attacker to craft malicious input that causes the library to consume excessive CPU resources, potentially freezing or crashing applications that process user-supplied Markdown.

Technical details

The vulnerability exists in the anchors subparser component of Showdown, which uses a nested regular expression to parse Markdown links. This regex pattern is susceptible to catastrophic backtracking when processing specially crafted input, leading to denial of service conditions. The attack is network-reachable and requires no authentication or user interaction beyond supplying malicious Markdown content; an attacker can send a maliciously formatted string to any application using Showdown to trigger the ReDoS. The vulnerable code affects all versions up to and including 2.1.0. A patch addressing this issue is expected to be available in future releases.

Affected products

  • Showdown Showdown <=2.1.0

Timeline

  • 2024-02-26: disclosed: GHSA-rmmh-p597-ppvv published
  • 2024-02-26: other: CVE-2024-1899 assigned

References

Related threats