CVE-2024-4067

Katalog CVE

CVSS 5.3 · Medium EPSS 1,4%

Kerentanan Inefficient Regular Expression Complexity pada jonschlinkert micromatch. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.

Rincian

Terbit di NVD

14 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade patch
• https://github.com/micromatch/micromatch/pull/266 issue tracking · patch
• https://github.com/micromatch/micromatch/pull/247 issue tracking · patch
• https://advisory.checkmarx.net/advisory/CVE-2024-4067/ exploit · advisory pihak ketiga
• https://devhub.checkmarx.com/cve-details/CVE-2024-4067/ advisory pihak ketiga
• https://github.com/micromatch/micromatch/releases/tag/4.0.8 release notes
• https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448 product
• https://github.com/micromatch/micromatch/issues/243 issue tracking