EIQ-2019-0038

EIQ-2019-0038

-

markdown-it is vulnerable to regular expression denial of service

21 Oct 2019

2 - MEDIUM

5.3

2.6.0

markdown-it versions 9.1.0 and earlier is vulnerable to regular expression denial of service (ReDoS).
Affected versions of the Node.js module may take quadratic time to parse crafted regular expressions such as the one in the following example:

A signed-in user without admin access rights could enter an iterative sequence of *_*_*_ characters in one of the following entity input fields:

• Summary (report entity type only).

• Analysis (all supported entity types).

The user would need at least this permission:

• modify blob-uploads

To exploit the vulnerability, the user would need to manually upload to the platform an entity in .json format.
The .json file would need to include the following custom JSON fields to enable markdown parsing in the Analysis (data.description) and Summary (data.short_description) fields, respectively:

• data.description_structuring_format": "md"

• data.short_description_structuring_format": "md"

The data.description (Analysis) and/or the data.short_description (Summary) fields would need to hold an extremely long iterative sequence of *_ characters.
The resulting .json file would be several MB in size.

Upon opening such a crafted .json entity in the entity detail panel, parsing the markdown input would take quadratic time, which is computationally expensive.
This may result in a denial of service (CPU consumption): the currently active entity detail pane may take some time to open, and it could freeze.

To restore the view, the user would need to refresh the browser tab.

The following example includes relevant fields from a report entity to show where in the entity JSON structure the data.description (Analysis) and/or the data.short_description (Summary) fields need to be included to exploit the vulnerability:

Upgrade to markdown-it version 10.0.0 or later.

To freeze the detail pane, the uploaded .json files containing the crafted payload exceeds 10 MB in size.
By default, it is not possible to manually upload to the platform files whose size exceeds 10 MB.
We recommend keeping the default value.

2.5.0 and earlier.

For more information, see:

• Snyk report about the vulnerability

• GitHub issue about the vulnerability

• GitHub commit with the fix