Executive brief
vue-moment is a Vue.js plugin that formats dates using the Moment.js library. Versions before 4.1.0 bundle an outdated copy of Moment.js (2.19.1) that contains a regular expression denial-of-service vulnerability. An attacker could craft malicious date input to trigger excessive CPU consumption, causing application slowdowns or service disruption.
Technical details
vue-moment bundles a static copy of moment@2.19.1 rather than declaring it as an updateable dependency, preventing automatic security updates. The bundled Moment.js version contains a Regular Expression Denial of Service (ReDoS) vulnerability (CWE-1104). An unauthenticated attacker with network access can supply malicious date strings to trigger excessive regex backtracking in Moment's parsing logic, causing CPU exhaustion and denial of service. Fix: upgrade to version 4.1.0 or later, which properly maintains Moment.js as an external dependency.
Affected products
- Brock Petrie vue-moment prior to 4.1.0
Timeline
- 2020-09-04: disclosed
- 2020-08-31: patched: Fix available in version 4.1.0