Woorank robots-txt-guard lib/patterns.js makePathPattern redos
A vulnerability was found in Woorank robots-txt-guard (version unknown). It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern with an unknown input leads to a redos vulnerability. Using CWE to declare the problem leads to CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Impacted is availability.
The weakness was presented 01/05/2023. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2021-4305. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1449.003.
The exploit is available at github.com. It is declared as proof-of-concept.
Applying the patch c03827cd2f9933619c23894ce7c98401ea824020 is able to eliminate this problem. The bugfix is ready for download at github.com.
Product
Vendor
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.8VulDB Meta Temp Score: 4.7
VulDB Base Score: 3.5
VulDB Temp Score: 3.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.5
NVD Vector: 🔍
CNA Base Score: 3.5
CNA Vector (VulDB): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: RedosCWE: CWE-1333 / CWE-400 / CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Partially
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | unlock | unlock | unlock | unlock |
|---|---|---|---|---|
| Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Patch: c03827cd2f9933619c23894ce7c98401ea824020
Timeline
01/05/2023 🔍01/05/2023 🔍
01/05/2023 🔍
01/28/2023 🔍
Sources
Advisory: c03827cd2f9933619c23894ce7c98401ea824020Status: Confirmed
CVE: CVE-2021-4305 (🔍)
GCVE (CVE): GCVE-0-2021-4305
GCVE (VulDB): GCVE-100-217448
scip Labs: https://www.scip.ch/en/?labs.20161013
Entry
Created: 01/05/2023 11:08Updated: 01/28/2023 15:36
Changes: 01/05/2023 11:08 (44), 01/28/2023 15:31 (3), 01/28/2023 15:36 (28)
Complete: 🔍
Cache ID: 152:AC2:65
No comments yet. Languages: en.
Please log in to comment.