PT-2021-23973 · Jsx-Slack · Jsx-Slack

Hieki · Published 2021-12-17 · Updated 2022-08-09 · CVE-2021-43843

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: jsx-slack versions 4.5.1 and earlier

Description: The issue is related to a Regular Expression Denial of Service (ReDoS) attack. If an attacker can put a lot of JSX elements into the <blockquote> tag with including multibyte characters, an internal regular expression for escaping characters may consume an excessive amount of computing resources. The patch in version 4.5.1 is insufficient for protection against this attack, as it only passes the test against ASCII characters but misses the case of multibyte characters.

Recommendations: For jsx-slack versions 4.5.1 and earlier, update to version 4.5.2, which has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. As a temporary workaround, consider restricting the use of the <blockquote> tag with multibyte characters until the issue is resolved.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CVE-2021-43843

GHSA-55XV-F85C-248Q

GHSA-HP68-XHVJ-X6J6

Affected Products

Jsx-Slack

References · 12

• 🔥 https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q · Exploit
• 🔥 https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6 · Exploit
• https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29ecc · Patch
• https://osv.dev/vulnerability/GHSA-hp68-xhvj-x6j6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43838 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-43843 · Security Note
• https://osv.dev/vulnerability/GHSA-55xv-f85c-248q · Vendor Advisory
• https://github.com/yhatt/jsx-slack/releases/tag/v4.5.2 · Note
• https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d · Note
• https://github.com/yhatt/jsx-slack/security · Note
• https://github.com/yhatt/jsx-slack · Note