CVE-2021-23343: Path-parse ReDoS Vulnerability

CVE-2021-23343 Overview

CVE-2021-23343 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting all versions of the path-parse npm package. The vulnerability exists in the splitDeviceRe, splitTailRe, and splitPathRe regular expressions used for parsing file paths. When processing maliciously crafted input strings, these regular expressions exhibit polynomial worst-case time complexity, allowing attackers to cause significant CPU resource exhaustion and application hangs.

Critical Impact
Attackers can exploit this vulnerability to cause denial of service conditions in Node.js applications by sending specially crafted path strings that trigger catastrophic backtracking in the vulnerable regular expressions, potentially rendering the application unresponsive.

Affected Products

path-parse (all versions) for Node.js
Applications using path-parse as a dependency
WebJars npm packages containing path-parse (SNYK-JAVA-ORGWEBJARSNPM-1279028)

Discovery Timeline

2021-05-04 - CVE-2021-23343 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-23343

Vulnerability Analysis

The path-parse package provides functionality to parse file paths into their constituent components (root, dir, base, ext, name). The vulnerability stems from inefficient regular expression patterns used internally for parsing operations. When these regular expressions process input strings containing certain character sequences, they enter a state of catastrophic backtracking.

ReDoS vulnerabilities occur when regular expressions can be manipulated to run in exponential or polynomial time rather than linear time. In the case of path-parse, the affected regular expressions (splitDeviceRe, splitTailRe, and splitPathRe) contain overlapping patterns that cause the regex engine to explore an exponentially growing number of possible matches when fed adversarial input.

The network attack vector combined with no required privileges means that any unauthenticated remote attacker can send malicious input to an application using path-parse, potentially causing denial of service. The primary impact is availability degradation, as the CPU becomes tied up processing the malicious regex operations.

Root Cause

The root cause is the use of regular expressions with nested quantifiers and overlapping alternations in the path parsing logic. These pattern constructs are known to be vulnerable to ReDoS attacks because they create ambiguous matching scenarios where the regex engine must backtrack extensively to determine the correct match.

The vulnerable regular expressions contain constructs that, when given carefully crafted input strings, force the JavaScript regex engine into a polynomial-time matching operation. This is a classic example of algorithmic complexity attack where the computational cost grows polynomially with input length.

Attack Vector

An attacker can exploit this vulnerability by sending a specially crafted path string to any application function that processes paths using the vulnerable path-parse package. The attack requires no authentication and can be conducted remotely over the network. Common attack scenarios include:

Submitting malicious file paths through file upload forms
Sending crafted path strings via API endpoints that process file paths
Injecting malicious paths through URL parameters or query strings
Any user-controlled input that eventually gets processed by path-parse

The attack causes the application's event loop to block while the regex engine attempts to process the malicious input, effectively causing a denial of service condition.

Detection Methods for CVE-2021-23343

Indicators of Compromise

Unusual CPU spikes in Node.js application processes
Application response time degradation when processing path-related operations
Event loop blocking or application hangs during file path parsing
Increased memory usage patterns correlated with path parsing functions

Detection Strategies

Monitor Node.js application performance metrics for CPU exhaustion patterns
Implement request timeout mechanisms to detect and terminate long-running path operations
Use application performance monitoring (APM) tools to track regex execution time
Review application logs for patterns indicating slow path parsing operations
Scan dependencies using npm audit or tools like Snyk to identify vulnerable path-parse versions

Monitoring Recommendations

Set up alerts for abnormal CPU utilization in Node.js processes
Implement request-level timeouts to prevent indefinite blocking
Monitor event loop lag metrics to detect potential ReDoS exploitation
Track and alert on unusual patterns in path-related API endpoints
Enable detailed logging for path parsing operations in production environments

How to Mitigate CVE-2021-23343

Immediate Actions Required

Audit your application dependencies for path-parse usage with npm ls path-parse
Update to the latest patched version of path-parse if available
Implement input validation to limit path string length before processing
Apply request timeouts to prevent long-running operations from blocking the application
Consider using Node.js built-in path module as an alternative where possible

Patch Information

The vulnerability affects all versions of path-parse. Organizations should check the GitHub Issue Discussion for the latest patch status and updates from the maintainer. Security advisories are available through Snyk JS Vulnerability Database and Snyk Java Vulnerability Database for WebJars users.

Workarounds

Implement strict input length validation for any user-controlled path strings before passing to path-parse
Use request timeout middleware to automatically terminate requests that exceed reasonable processing time
Consider replacing path-parse with Node.js native path.parse() function which is not affected
Implement rate limiting on endpoints that process file paths to reduce attack surface
Deploy Web Application Firewall (WAF) rules to detect and block suspiciously long path strings

bash

# Check for vulnerable path-parse in your project
npm ls path-parse

# Audit dependencies for known vulnerabilities
npm audit

# Update to latest version if patch is available
npm update path-parse