Executive brief
millisecond is a JavaScript library used to parse human-readable time duration strings (like "5 minutes") into milliseconds. The library is vulnerable to a denial-of-service attack when processing extremely long version strings, which can cause the application to hang or become unresponsive, potentially disrupting service availability.
Technical details
This is a regular expression denial of service (ReDoS) vulnerability in the millisecond parsing logic. When the library processes extremely long input strings, the regex used for parsing exhibits catastrophic backtracking, causing CPU utilization to spike and the application to hang. The vulnerability affects all versions prior to 0.1.2. An attacker can trigger this by providing a crafted long string to any code that passes untrusted input to the millisecond function. The fix involves adding input length validation to reject overly long strings before they reach the vulnerable regex.
Affected products
- unshiftio millisecond 0.1.1 and earlier
Timeline
- 2021-09-22: disclosed
- 2015-11-20: patched: Fix merged in GitHub PR #4 to version 0.1.2