CVE-2024-4067: Regular Expression Denial of Service in micromatch
Node.js micromatch module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in micromatch.braces() in index.js. By sending a specially crafted payload, a remote attacker could exploit this vulnerability to increase the consumption time until the application hangs or slows down.
Other sources
The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern . will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
https://devhub.checkmarx.com/cve-details/CVE-2024-4067/ https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448 https://github.com/micromatch/micromatch/issues/243 https://github.com/micromatch/micromatch/pull/247
— Red Hat
The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern . will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
— NVD
The NPM package micromatch prior to version 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern . will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persisted prior to https://github.com/micromatch/micromatch/pull/266. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/micromatchto a version that resolves this vulnerability.Fixed in 4.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4067?
CVE-2024-4067 is classified as a denial of service vulnerability due to a regex ReDoS flaw in the micromatch module.
How do I fix CVE-2024-4067?
To fix CVE-2024-4067, upgrade the micromatch package to version 4.0.8 or later.
What software is affected by CVE-2024-4067?
CVE-2024-4067 affects the micromatch module and IBM Cognos Dashboards on Cloud Pak for Data versions up to 5.0.0.
Can CVE-2024-4067 be exploited remotely?
Yes, CVE-2024-4067 can be exploited remotely by sending specially crafted payloads to the affected application.
What is the impact of CVE-2024-4067?
The impact of CVE-2024-4067 includes potential service downtime and resource exhaustion due to increased consumption time.