Listen to this Post
The parsePatch method in the jsdiff library contains a critical flaw when processing patch filename headers. If these headers include specific line break characters—namely \r, \u2028, or \u2029—the parsing logic enters an infinite loop. This occurs due to improper handling of these characters in the string parsing routines, causing the method to repeatedly allocate memory without termination. Consequently, the process memory usage escalates uncontrollably until exhaustion, leading to a crash and denial-of-service. This vulnerability is exploitable with minimal input size, rendering standard input length restrictions ineffective. Even patches generated internally can be vulnerable if user-controlled filenames incorporate these characters. The applyPatch method is also impacted when invoked with a string patch, as it relies internally on parsePatch. Separately, a ReDOS vulnerability exists in the patch header parsing: when the same line break characters appear in the “leading garbage” section, parsing time increases cubically with header length (O(n³)), allowing for resource exhaustion attacks. Both issues stem from inadequate sanitization of control characters in regex or string matching functions within the library’s patch parsing implementation.
Platform: jsdiff
Version: <8.0.3
Vulnerability: Infinite loop DoS
Severity: Critical
date: Not specified
Prediction: Fixed in v8.0.3
What Undercode Say:
Analytics:
Bash commands to check and manage jsdiff versions:
npm list jsdiff npm show jsdiff version npm install [email protected] npm update [email protected]
Code snippet demonstrating vulnerable parsePatch usage:
const jsdiff = require('jsdiff');
const maliciousPatch = <code>a/file\u2028name.txt\n+++ b/file\u2028name.txt\n@@ -1 +1 @@\n- old\n+ new</code>;
// This call may cause infinite loop or ReDOS
const parsed = jsdiff.parsePatch(maliciousPatch);
how Exploit:
Craft patch with filename headers containing \r, \u2028, or \u2029. Submit to application using parsePatch or applyPatch with string input. Trigger infinite loop for DoS or ReDOS for resource exhaustion.
Protection from this CVE Impact:
Upgrade to jsdiff v8.0.3. Sanitize inputs to remove line break characters. Impact: Denial-of-service, memory exhaustion, and performance degradation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
