CVE-2022-21680: Cubic catastrophic backtracking (ReDoS) in marked
Impact
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings. PoC is the following.
javascript import as marked from "marked";
marked.parse([x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Patches
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
References
Are there any links users can visit to find out more?
- https://marked.js.org/usingadvanced#workers - https://owasp.org/www-community/attacks/RegularexpressionDenialofService-ReDoS
For more information
If you have any questions or comments about this advisory:
Open an issue in marked
Other sources
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/markedto a version that resolves this vulnerability.Fixed in 4.0.10 - Upgrade
Upgrade
redhat/markedjsto a version that resolves this vulnerability.Fixed in 4.0.10 - Upgrade
Upgrade
debian/node-markedto a version that resolves this vulnerability.Fixed in 4.2.3+ds+~4.0.7-2Fixed in 4.2.3+ds+~4.0.7-4Fixed in 18.1.1+~cs7.2.18-1 - Upgrade
Upgrade
debian/node-markedto a version that resolves this vulnerability.Fixed in 4.0.12+ds+~4.0.1-1 - Upgrade
Upgrade
markedjs/markedto a version that resolves this vulnerability.Fixed in 4.0.10Patch GHSA-rrrm-qjm4-v8hf - Compensating control
Do not run untrusted markdown through marked; alternatively, run marked in a worker thread and set a reasonable time limit to prevent resource draining (ReDoS workaround).
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21680?
The severity of CVE-2022-21680 is classified as a denial of service vulnerability.
How can CVE-2022-21680 be exploited?
CVE-2022-21680 can be exploited through specially crafted input that causes catastrophic backtracking in the regular expression `block.def`.
How do I fix CVE-2022-21680?
To fix CVE-2022-21680, upgrade to marked version 4.0.10 or later.
What software is affected by CVE-2022-21680?
CVE-2022-21680 affects the marked package versions prior to 4.0.10.
Is CVE-2022-21680 relevant to specific operating systems?
Yes, CVE-2022-21680 is relevant to systems using marked, including those running Fedora 36.