CVE-2017-15010: High severity Salesforce Tough-cookie Node.js vulnerability

Affected versions of tough-cookie are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.

If node was compiled using the -DHTTPMAXHEADERSIZE however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.

Recommendation

Update to version 2.3.3 or later.

It was found that the tough-cookie module is vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds.

Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb so the impact of the ReDoS is limited to around 7.3 seconds of blocking.

Upstream issue:

https://github.com/salesforce/tough-cookie/issues/92

Upstream patch: https://github.com/salesforce/tough-cookie/commit/98e0916d7b017669c93855d831c6e0b19c14141e

— Red Hat

Node.js is vulnerable to a denial of service, caused by a flaw in the tough-cookie module. By sending a specially-crafted HTTP request, a remote attacker could exploit this vulnerability to cause a regular expression denial of service.

— IBM