GHSA-p9wx-2529-fp83 CVE-2018-25110
Marked allows Regular Expression Denial of Service (ReDoS) attacks
- Severity
- 6.9 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.61%
- Chance of exploitation in the next 30 days. Higher than 49.23% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
0.3.17- Upgrade marked to this version or later
Description
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
marked npm → 0.3.17
- npm
npm install marked@0.3.17- yarn
yarn add marked@0.3.17- pnpm
pnpm add marked@0.3.17
Severity breakdown
CVSS 4.0 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6v9c-7cg6-27q7 Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer | High | Also affects marked |
| GHSA-5v2h-r2cx-5xgj Inefficient Regular Expression Complexity in marked | High | Also affects marked |
| GHSA-rrrm-qjm4-v8hf Inefficient Regular Expression Complexity in marked | High | Also affects marked |
| GHSA-4r62-v4vq-hr96 Regular Expression Denial of Service (REDoS) in Marked | High | Also affects marked |
| GHSA-ch52-vgq2-943f Regular Expression Denial of Service in marked | Low | Also affects marked |
| GHSA-9cw2-jqp5-7x39 Multiple Content Injection Vulnerabilities in marked | Medium | Also affects marked |
| GHSA-xf5p-87ch-gxw2 Marked ReDoS due to email addresses being evaluated in quadratic time | Medium | Also affects marked |
| GHSA-vfvf-mqq8-rwqc Sanitization bypass using HTML Entities in marked | Medium | Also affects marked |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor