Listen to this Post
This vulnerability affects the league/commonmark Markdown parser for PHP. It stems from three distinct algorithmic complexity issues found in two optional extensions: SmartPunctExtension and AttributesExtension. These extensions are not enabled by default, meaning applications that do not explicitly register them are not vulnerable. The core issue is that processing certain crafted inputs causes the parser to perform a quadratic number of operations, leading to excessive CPU consumption.
The first vulnerability is in SmartPunctExtension, which converts quotes and apostrophes. The ReplaceUnpairedQuotesListener merges text nodes after processing. Due to how the AdjacentTextMerger works, each merge operation copies the entire accumulated text string, not just the new bytes. If a document has many unpaired quotes, the parser repeatedly recopies a growing buffer, leading to O(n²) time complexity. A document of 1.2 MB could take nearly 35 seconds to convert, compared to 0.07 seconds for a normal document.
The second issue is in AttributesExtension’s block-level attribute handling. The findTargetAndDirection() method scans the sibling chain for every attribute node. When a contiguous run of these nodes exists, the scan repeats work for each node, resulting in O(k²) steps for a run of k nodes. A crafted input with 16,000 attribute blocks takes over 28 seconds to process and produces no output.
The third vulnerability also lies in AttributesExtension. The mergeAttributes() function uses explode and implode to manipulate class lists on every merge operation. When processing many `.class` attributes, this causes each merge to cost proportional to the current length, leading to O(n²) overhead. With 32,000 repetitions, processing takes 33.5 seconds, compared to 0.26 seconds for a similar `id` attribute. These issues allow an attacker to cause a denial of service by submitting specially crafted Markdown that consumes CPU resources on the server.
DailyCVE Form:
Platform: PHP league/commonmark
Version: 1.5.0 – 2.9.0
Vulnerability : Algorithmic Complexity (DoS)
Severity: Medium (6.5)
date: 2025-03-23
Prediction: Patched (2025-03-19)
What Undercode Say:
Identify vulnerable version composer show league/commonmark | grep versions Check if extensions are registered grep -r "SmartPunctExtension" ./ grep -r "AttributesExtension" ./
Exploit: (Educational Purposes!)
// Exploit for SmartPunctExtension (O(n^2) text recopy)
$payload = str_repeat("a'", 600000); // 1.2MB document
// Exploit for AttributesExtension (block-level re-scan)
$payload = str_repeat("{a}\n", 16000) . "[bash]: /";
// Exploit for AttributesExtension (class list rebuild)
$payload = str_repeat("{.c}\n", 32000);
Protection:
// 1. Do not register vulnerable extensions for untrusted input
$environment = Environment::createCommonMarkEnvironment();
// DO NOT: $environment->addExtension(new SmartPunctExtension());
// DO NOT: $environment->addExtension(new AttributesExtension());
// 2. Upgrade to patched version (2.9.1+)
composer require league/commonmark:^2.9.1
// 3. Limit input length
if (strlen($input) > 100000) {
throw new Exception("Input too large");
}
// 4. Set execution time limits
set_time_limit(5);
Impact:
- Remote attackers can cause significant CPU consumption via crafted Markdown.
- Leads to denial of service by occupying PHP worker processes.
- No data disclosure, output alteration, or security controls bypass.
- Affects applications using SmartPunctExtension or AttributesExtension.
- Library-level hardening (allow-lists, event handlers) does not mitigate.
- Fixed in versions 2.9.1 and later. 1.x line is not supported.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
