PT-2021-23969 · Jsx-Slack · Jsx-Slack

Hieki · Published 2021-12-17 · Updated 2023-07-21 · CVE-2021-43838

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: jsx-slack versions prior to 4.5.1

Description: The issue concerns a regular expression denial-of-service (ReDoS) attack. If an attacker can put a lot of JSX elements into the <blockquote> tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources.

Recommendations: For versions prior to 4.5.1, upgrade to version 4.5.1 or later as soon as possible to patch the regex for escaping blockquote characters. For version 4.5.1, note that while it has a patched workaround, it is still vulnerable to contents with multibyte characters, so upgrading to version 4.5.2 is recommended to fully prevent catastrophic backtracking.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CVE-2021-43838

GHSA-55XV-F85C-248Q

Affected Products

Jsx-Slack

References · 7

• 🔥 https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q · Exploit
• https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d · Patch
• https://osv.dev/vulnerability/CVE-2021-43838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43838 · Security Note
• https://osv.dev/vulnerability/GHSA-55xv-f85c-248q · Vendor Advisory
• https://github.com/yhatt/jsx-slack · Note
• https://t.me/cibsecurity/34234 · Telegram Post