CVE-2022-21681: Exponential catastrophic backtracking (ReDoS) in marked
Impact
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings. PoC is the following.
javascript import as marked from 'marked';
console.log(marked.parse([x]: x
\\\\);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Patches
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
References
Are there any links users can visit to find out more?
- https://marked.js.org/usingadvanced#workers - https://owasp.org/www-community/attacks/RegularexpressionDenialofService-ReDoS
For more information
If you have any questions or comments about this advisory:
Open an issue in marked
Other sources
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/markedto a version that resolves this vulnerability.Fixed in 4.0.10 - Upgrade
Upgrade
redhat/markedjsto a version that resolves this vulnerability.Fixed in 4.0.10 - Upgrade
Upgrade
debian/node-markedto a version that resolves this vulnerability.Fixed in 4.2.3+ds+~4.0.7-2Fixed in 4.2.3+ds+~4.0.7-4Fixed in 18.1.1+~cs7.2.18-1 - Upgrade
Upgrade
debian/node-markedto a version that resolves this vulnerability.Fixed in 4.0.12+ds+~4.0.1-1 - Upgrade
Upgrade
markedjs/markedto a version that resolves this vulnerability.Fixed in 4.0.10Patch GHSA-5v2h-r2cx-5xgj - Compensating control
If you run marked on a worker thread, set a reasonable time limit on the worker to prevent resource draining (avoid running untrusted markdown through marked without a worker time limit).
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21681?
CVE-2022-21681 has a severity designation of Denial of Service.
How do I fix CVE-2022-21681?
To mitigate CVE-2022-21681, upgrade to marked version 4.0.10 or later.
Which versions of marked are affected by CVE-2022-21681?
CVE-2022-21681 affects all versions of marked prior to 4.0.10.
What impact does CVE-2022-21681 have?
CVE-2022-21681 can lead to a denial of service due to catastrophic backtracking in the regular expression used.
Is there a proof of concept for CVE-2022-21681?
Yes, a proof of concept for CVE-2022-21681 demonstrates the exploitation of the vulnerability.