Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:43532
HistoryOct 04, 2023 - 12:48 p.m.

Regular Expression Denial Of Service (ReDoS)

2023-10-0412:48:26
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
get-func-name
vulnerability
regular expression denial of service
index.js
functionsource
dos attack
input
excessive backtracking
software

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

7

Confidence

High

EPSS

0.001

Percentile

20.5%

get-func-name is vulnerable to Regular Expression Denial Of Service. The vulnerability is due to the getFuncName function in index.js not properly checking the functionSource size and length. which allows an attacker to trigger a DOS attack by using an input like '\t'.repeat(54773) + '\t/function/i', which exploits the regular expressionโ€™s weakness in functionNameMatch to create excessive backtracking.

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

7

Confidence

High

EPSS

0.001

Percentile

20.5%