Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2021-23343

Description

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

POC

Reference

- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279028

- https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067

Github

- https://github.com/1345122890/1345122890

- https://github.com/1345122890/mmcloud

- https://github.com/ARPSyndicate/cvemon

- https://github.com/Amichaii/EVERWallet

- https://github.com/Andreablog/OpenEV

- https://github.com/DanielBanasiuk/Kuliah

- https://github.com/DanilPetelin/FlutterLNotificationsp

- https://github.com/DenverCat/Yogi

- https://github.com/JuliaLiootti/PS4G

- https://github.com/MexicoBen/nInstalls

- https://github.com/NatalieYeah/robmikh

- https://github.com/Sydneypom/CModules

- https://github.com/VanconVincius/Tomasz-Mankowski

- https://github.com/WiliamBroown/Volunteer

- https://github.com/broxus/ever-wallet-browser-extension

- https://github.com/broxus/ever-wallet-browser-extension-old

- https://github.com/engn33r/awesome-redos-security

- https://github.com/lSGerald/sentinel-officialc

- https://github.com/marcosrg9/YouTubeTV

- https://github.com/vitaliydrebotiz/vitaliydrebotiz