Vigil@nce - Node.js milliseconds: denial of service via Regular Expression
January 2016 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can provide a complex string to Node.js milliseconds,
in order to trigger a denial of service.
Impacted products: Node.js Modules not comprehensive.
Severity: 2/4.
Creation date: 23/11/2015.
DESCRIPTION OF THE VULNERABILITY
The milliseconds module can be installed on Node.js.
However, the conversion of a string (such as "10 minutes") uses a
Regular Expression which consumes a lot of resources when the
string is larger than 10kb.
An attacker can therefore provide a complex string to Node.js
milliseconds, in order to trigger a denial of service.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN