CVE-2021-23446:Regular Expression Denial of Service (ReDoS) vulnerability in Handsontable before version 10.0.0

splash
Back

Description Preview

Handsontable versions prior to 10.0.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in the Handsontable.helper.isNumeric function. This vulnerability could allow attackers to cause denial of service by providing specially crafted input that causes the regular expression engine to enter a highly resource-intensive state, potentially making the application unresponsive.

Overview

The vulnerability exists in the Handsontable JavaScript library, which is a popular data grid component for web applications. The issue is specifically in the isNumeric helper function that uses a regular expression pattern vulnerable to catastrophic backtracking. When this function processes malicious input designed to exploit this vulnerability, it can cause excessive CPU usage and potentially freeze the application or service. This vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity), which can lead to denial of service conditions when processing user-controlled input.

Remediation

Users should upgrade to Handsontable version 10.0.0 or later, which contains a fix for this vulnerability. If upgrading is not immediately possible, consider implementing input validation before passing data to the Handsontable component, particularly for user-supplied data that might be processed by the isNumeric function. Limiting the length or complexity of input strings can also help mitigate the risk until a proper upgrade can be performed.

The vulnerability was fixed in pull request #8742 (https://github.com/handsontable/handsontable/pull/8742), which improved the regular expression pattern in the isNumeric function to prevent catastrophic backtracking.

References

  1. Issue report: https://github.com/handsontable/handsontable/issues/8752
  2. Fix pull request: https://github.com/handsontable/handsontable/pull/8742
  3. Snyk JavaScript vulnerability report: https://snyk.io/vuln/SNYK-JS-HANDSONTABLE-1726770
  4. Snyk .NET vulnerability report: https://snyk.io/vuln/SNYK-DOTNET-HANDSONTABLE-1726793
  5. Snyk Java vulnerability reports:
    • https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1726795
    • https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1726796
    • https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBHANDSONTABLE-1726794
    • https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1726797

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing
    Manufacturing
  2. Management of Companies & Enterprises
    Management of Companies & Enterprises
  3. Transportation & Warehousing
    Transportation & Warehousing
  4. Accommodation & Food Services
    Accommodation & Food Services
  5. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  6. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  7. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  8. Construction
    Construction
  9. Educational Services
    Educational Services
  10. Finance and Insurance
    Finance and Insurance
  11. Health Care & Social Assistance
    Health Care & Social Assistance
  12. Information
    Information
  13. Mining
    Mining
  14. Other Services (except Public Administration)
    Other Services (except Public Administration)
  15. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  16. Public Administration
    Public Administration
  17. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  18. Retail Trade
    Retail Trade
  19. Utilities
    Utilities
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background