walletgeneratornet / WalletGenerator.net

Universal JavaScript Client-Side Wallet Generator
http://walletgenerator.net/
650 stars 558 forks source link

Regular Expression Denial of Service (DoS) #254

Open larrycameron80 opened 5 years ago

larrycameron80 commented 5 years ago

Regular Expression Denial of Service (DoS) Vulnerable module: minimatch Introduced through: grunt@0.4.5 Detailed paths Introduced through: walletgenerator.net@walletgeneratornet/WalletGenerator.net › grunt@0.4.5 › findup-sync@0.1.3 › glob@3.2.11 › minimatch@0.3.0 Remediation: Upgrade to grunt@1.0.0. Introduced through: walletgenerator.net@walletgeneratornet/WalletGenerator.net › grunt@0.4.5 › minimatch@0.2.14 Remediation: Upgrade to grunt@1.0.0. Introduced through: walletgenerator.net@walletgeneratornet/WalletGenerator.net › grunt@0.4.5 › glob@3.1.21 › minimatch@0.2.14 Remediation: Upgrade to grunt@1.0.0. Overview minimatch is a minimalistic matching library used for converting glob expressions into JavaScript RegExp objects. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Many Regular Expression implementations may reach edge cases that causes them to work very slowly (exponentially related to input size), allowing an attacker to exploit this and can cause the program to enter these extreme situations by using a specially crafted input and cause the service to excessively consume CPU, resulting in a Denial of Service.

An attacker can provide a long value to the minimatch function, which nearly matches the pattern being matched. This will cause the regular expression matching to take a long time, all the while occupying the event loop and preventing it from processing other requests and making the server unavailable (a Denial of Service attack).