PT-2023-28897 · Unknown+2 · Get-Func-Name+2

Gap-Dev · Published 2023-09-26 · Updated 2023-10-02 · CVE-2023-43646

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions get-func-name versions prior to 2.0.1

Description The issue is related to a regular expression denial of service (redos) vulnerability in the get-func-name module, which can lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, resulting in excessive backtracking and increased CPU load and processing time. The vulnerability can be triggered using a specific input, such as 't'.repeat(54773) + 't/function/i'. The regex implementation in question is susceptible to excessive backtracking, leading to potential DoS attacks.

Recommendations For versions prior to 2.0.1, upgrade to version 2.0.1 or later to address the issue. As a temporary workaround, consider restricting the use of the vulnerable functionNameMatch regex implementation until a patch is available. Avoid using the functionNameMatch regex with untrusted input until the issue is resolved. At the moment, there are no known workarounds for this vulnerability other than upgrading to a fixed version.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CVE-2023-43646

GHSA-4Q6P-R6V2-JVC5

Affected Products

Astra Linux

Debian

Get-Func-Name

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43646.json · Exploit
• 🔥 https://github.com/chaijs/get-func-name/security/advisories/GHSA-4q6p-r6v2-jvc5 · Exploit
• https://github.com/chaijs/get-func-name/commit/f934b228b5e2cb94d6c8576d3aac05493f667c69 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-43646 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4q6p-r6v2-jvc5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43646 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-43646 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43646 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-43646 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-43646 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-43646 · Vendor Advisory
• https://github.com/chaijs/get-func-name/blob/78ad756441a83f3dc203e50f76c113ae3ac017dc/index.js#L15 · Note
• https://github.com/chaijs/get-func-name · Note
• https://t.me/cibsecurity/71088 · Telegram Post
• https://twitter.com/IT_securitynews/status/1708414708615721088 · Twitter Post