PT-2023-10614 · Vercel · Vercel Ms

Published 2023-01-05 · Updated 2024-05-17 · CVE-2017-20162

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions vercel ms versions up to 1.x

Description A problematic issue has been found in the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For vercel ms versions up to 1.x, upgrade to version 2.0.0 to address this issue. As a temporary workaround, consider restricting the use of the parse function in the index.js file until the patch is applied. Restrict access to the str argument to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

AZL-43849

AZL-44002

AZL-45126

AZL-45201

CVE-2017-20162

GHSA-W9MR-4MFR-499F

Affected Products

Vercel Ms

References · 18

• 🔥 https://github.com/vercel/ms/pull/89 · Exploit
• https://github.com/vercel/ms/commit/caae2988ba2a37765d055c4eee63d383320ee662 · Patch
• https://github.com/vercel/ms/releases/tag/2.0.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-20162 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20162 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43849 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w9mr-4mfr-499f · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45126 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-20162 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45201 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44002 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-20162 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-20162 · Security Note
• https://github.com/vercel/ms · Note
• https://t.me/cvenotify/41295 · Telegram Post