NetSight
IP …
medium5.3

CVE-2022-25901

cookiejar Regular Expression Denial of Service via Cookie.parse function

Impact

Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `Cookie.parse` function and other aspects of the API, which use an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers. Proof of concept: ``` ts\nconst { CookieJar } = require("cookiejar"); const jar = new CookieJar(); const start = performance.now(); const attack = "a" + "t".repeat(50_000); jar.setCookie(attack); console.log(`CookieJar.setCookie(): ${performance.now() - start}ms`); ``` ``` CookieJar.setCookie(): 2963.214399999939ms ```

Affected packages

EcosystemPackageAffectedFixed in
npmcookiejar< 2.1.42.1.4
mavenorg.webjars.npm:cookiejar<= 2.1.3none recorded

Affected products

VendorProductAffected versions
Cookiejar ProjectCookiejar
through 2.1.3

Weakness classification

CWE-1333

References