CVE-2018-1107: Inefficient Regular Expression Complexity vulnerability in is-my-json-valid (npm)

What is CVE-2018-1107 About?

This vulnerability is a Regular Expression Denial of Service (ReDoS) in the `is-my-json-valid` JavaScript library. It arises from an inefficient regular expression used for email format validation, leading to excessive CPU consumption. Exploitation is triggered by validating a specially crafted JSON file.

Affected Software

is-my-json-valid
- >2.0.0, <2.17.2
- <1.4.1

Technical Details

The is-my-json-valid JavaScript library utilizes an inefficient regular expression for validating JSON fields declared to have an email format. When a specially crafted JSON file containing a malicious string in an email field is presented for validation, the regular expression engine suffers from catastrophic backtracking. This causes the validation process to consume an inordinate amount of CPU time, making the application unresponsive and leading to a Denial of Service condition.

What is the Impact of CVE-2018-1107?

Successful exploitation may allow attackers to cause excessive CPU consumption, making the application unresponsive, and leading to a denial of service for users.

What is the Exploitability of CVE-2018-1107?

Exploitation involves supplying a specially crafted JSON file containing a malicious string in a field subject to email format validation. The complexity is low to moderate, requiring knowledge of ReDoS attack patterns. No authentication is required if the attacker can submit JSON data for validation. This is typically a remote exploitation scenario if user-supplied JSON is processed, but could be local if an attacker can provide file input. The primary risk factor is the acceptance of untrusted JSON input that is then validated using the vulnerable regex.

What are the Known Public Exploits?

PoC Author	Link	Commentary
No known exploits

What are the Available Fixes for CVE-2018-1107?

Available Upgrade Options

is-my-json-valid
- <1.4.1 → Upgrade to 1.4.1
is-my-json-valid
- >2.0.0, <2.17.2 → Upgrade to 2.17.2

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2018-1107?

Similar Vulnerabilities: CVE-2016-10537 , CVE-2017-16138 , CVE-2017-20165 , CVE-2018-16461 , CVE-2019-8331

CVE-2018-1107 Inefficient Regular Expression Complexity vulnerability in is-my-json-valid (npm)