The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop.
The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
Характеристики атаки
Способ атаки
По сети
Атака возможна удалённо
Сложность
Низкая
Легко эксплуатировать
Нужны права
Не требуются
Права не нужны
Участие пользователя
Не требуется
Не нужно действие пользователя
Последствия
Конфиденциальность
Нет
Нет утечки данных
Целостность
Нет
Нет модификации данных
Доступность
Низкое
Частичное нарушение работы
Строка CVSS v3.1
Тип уязвимости (CWE)
Уязвимые продукты
juliangruber:brace-expansion
Ссылки 5
https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2…
https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr
https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b1…
https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96
https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039c…
https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22
https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff…
https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364
https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f…
https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e