GHSA-9h6g-pr28-7cqp: nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
Summary A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter attachDataUrls set, causing the stuck of event loop. Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop.
Details
Regex: /^data:((?:[^;];)(?:[^,])),(.)$/
Path: compile -> getAttachments -> processDataUrl
Regex: /(<img\b[^>] src\s=[\s"'])(data:([^;]+);[^"'>\s]+)/
Path: convertDataImages
PoC
https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6 https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698
Impact
ReDoS causes the event loop to stuck a specially crafted evil email can cause this problem.
Other sources
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nodemailerto a version that resolves this vulnerability.Fixed in 6.9.9
Event History
Frequently Asked Questions
What is the severity of GHSA-9h6g-pr28-7cqp?
The severity of GHSA-9h6g-pr28-7cqp is classified as high due to potential denial of service through event loop blocking.
How do I fix GHSA-9h6g-pr28-7cqp?
To fix GHSA-9h6g-pr28-7cqp, upgrade to nodemailer version 6.9.9 or later.
What components of nodemailer are affected by GHSA-9h6g-pr28-7cqp?
GHSA-9h6g-pr28-7cqp affects nodemailer versions up to and including 6.9.8 when using attachDataUrls or parsing attachments with embedded files.
What type of vulnerability is GHSA-9h6g-pr28-7cqp?
GHSA-9h6g-pr28-7cqp is a Regular Expression Denial of Service (ReDoS) vulnerability.
When was GHSA-9h6g-pr28-7cqp disclosed?
GHSA-9h6g-pr28-7cqp was disclosed on October 25, 2023.