Description Preview
Minimatch is a JavaScript utility used for matching file paths against glob patterns by converting these patterns into regular expressions. In versions 3.0.1 and earlier, when the minimatch(path, pattern) function processes user-controlled pattern inputs, it can be forced into processing extremely inefficient regular expressions that cause excessive CPU consumption, leading to a denial of service condition. This vulnerability allows attackers to provide specially crafted patterns that cause the application to hang or become unresponsive.
Overview
Minimatch is widely used in Node.js applications for file path matching and glob pattern processing. The vulnerability exists in the core matching functionality where user-supplied glob patterns are converted to regular expressions without proper validation or safeguards against exponential backtracking. When a malicious pattern is processed, it can trigger catastrophic backtracking in the regular expression engine, causing the application to consume excessive CPU resources and potentially become unresponsive. This is particularly dangerous in server environments where the application processes user input directly or indirectly through this library.
Remediation
To remediate this vulnerability, take the following actions:
- Update Minimatch to version 3.0.2 or later, which includes fixes for this ReDoS vulnerability.
- If immediate updating is not possible, implement input validation to restrict the complexity of patterns passed to the minimatch function.
- Consider adding timeout mechanisms when processing potentially untrusted pattern inputs.
- Review your application for instances where user input might be passed to minimatch, either directly or indirectly.
- Monitor CPU usage of applications using Minimatch to detect potential exploitation attempts.
References
- Node Security Project Advisory: https://nodesecurity.io/advisories/118
- CWE-20: Improper Input Validation - https://cwe.mitre.org/data/definitions/20.html
- OWASP Regular Expression Denial of Service - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- ManufacturingManufacturing
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- Retail TradeRetail Trade
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- Finance and InsuranceFinance and Insurance
- Public AdministrationPublic Administration
- Health Care & Social AssistanceHealth Care & Social Assistance
- Transportation & WarehousingTransportation & Warehousing
- Educational ServicesEducational Services
- Other Services (except Public Administration)Other Services (except Public Administration)
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- ConstructionConstruction
- InformationInformation
- MiningMining
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
