PT-2024-7917 · Unknown+3 · Micromatch+3
Mário Teixeira
·
Published
2024-01-04
·
Updated
2026-06-04
·
CVE-2024-4067
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
micromatch versions prior to 4.0.8
Description
The vulnerability occurs in
micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.Recommendations
For versions prior to 4.0.8, update to version 4.0.8 to resolve the issue.
As a temporary workaround, consider using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Restrict access to the
micromatch.braces() function in index.js to minimize the risk of exploitation.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Red Os
Suse
Micromatch