Junglewise Threat Intelligence

millisecond regular expression denial of service

Severity: info · Published 2021-09-22

Vendors: npm.

Executive brief

millisecond is a JavaScript library used to parse human-readable time duration strings (like "5 minutes") into milliseconds. The library is vulnerable to a denial-of-service attack when processing extremely long version strings, which can cause the application to hang or become unresponsive, potentially disrupting service availability.

Technical details

This is a regular expression denial of service (ReDoS) vulnerability in the millisecond parsing logic. When the library processes extremely long input strings, the regex used for parsing exhibits catastrophic backtracking, causing CPU utilization to spike and the application to hang. The vulnerability affects all versions prior to 0.1.2. An attacker can trigger this by providing a crafted long string to any code that passes untrusted input to the millisecond function. The fix involves adding input length validation to reject overly long strings before they reach the vulnerable regex.

Affected products

  • unshiftio millisecond 0.1.1 and earlier

Timeline

  • 2021-09-22: disclosed
  • 2015-11-20: patched: Fix merged in GitHub PR #4 to version 0.1.2

References