Is CVE-2024-45813 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-45813 being exploited in the wild.

How severe is CVE-2024-45813?

Low severity, with a CVSS score of 3.1, published 18 September 2024.

Which products and versions are affected?

find-my-way (npm) SEMVER:introduced=5.5.0,fixed=8.2.2.

Is there a fix for CVE-2024-45813?

Yes. find-my-way (npm): upgrade to 8.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-45813 attacked?

It is attacked over the network.

Am I affected by CVE-2024-45813?

Check whether you run find-my-way (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-45813: find-my-way ReDoS vulnerability in multiparametric routes

CVE-2024-45813 · Severity: low · CVSS 3.1 · Published 2024-09-18

find-my-way is a JavaScript router library used in web applications to match HTTP requests to route handlers. A poorly constructed regular expression in the router's path parsing can be exploited through specially crafted URLs with multiparametric segments, causing excessive CPU consumption and making the application unresponsive. This type of attack (ReDoS) can lead to denial of service for legitimate users.

Technologies: find-my-way (npm). Vendors: npm.

Quick answers

Is CVE-2024-45813 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-45813 being exploited in the wild.
How severe is CVE-2024-45813?: Low severity, with a CVSS score of 3.1, published 18 September 2024.
Which products and versions are affected?: find-my-way (npm) SEMVER:introduced=5.5.0,fixed=8.2.2.
Is there a fix for CVE-2024-45813?: Yes. find-my-way (npm): upgrade to 8.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45813 attacked?: It is attacked over the network.
Am I affected by CVE-2024-45813?: Check whether you run find-my-way (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

find-my-way (npm): upgrade to 8.2.2 or later
```
npm install find-my-way@8.2.2
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) issue classified as CWE-1333. It occurs when a route pattern contains two parameters within a single segment followed by a dash (e.g., /:a-:b-), which causes the route compilation logic to generate an inefficient regular expression with exponential backtracking behavior. An attacker can send crafted HTTP requests matching these patterns to trigger worst-case regex performance, consuming CPU resources and degrading application availability. No privileges or authentication are required to exploit this vulnerability. The issue affects find-my-way versions 5.5.0 through 8.2.1 and version 9.0.0; patches are available in versions 8.2.2 and 9.0.1 or later.

Affected products

delvedor find-my-way 5.5.0 through 8.2.1; 9.0.0

Identifiers

CVE-2024-45813
GHSA-rrr8-f88r-h8q6

Timeline

2024-09-18: disclosed
2024-09-18: patched: v8.2.2 and v9.0.1 released

References

https://github.com/delvedor/find-my-way/security/advisories/GHSA-rrr8-f88r-h8q6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.