CVE-2021-23424: Ansi-html DoS Vulnerability

CVE-2021-23424 Overview

CVE-2021-23424 is a Denial of Service vulnerability affecting all versions of the ansi-html npm package. The ansi-html library is commonly used to convert ANSI escape codes to HTML, making it popular in web development build tools, terminals, and logging applications. When an attacker provides a maliciously crafted string to the vulnerable function, the package becomes stuck processing the input for an extremely long time, effectively causing a Denial of Service condition.

Critical Impact

All versions of the ansi-html package are vulnerable to algorithmic complexity attacks that can render applications unresponsive when processing attacker-controlled input.

Affected Products

• ansi-html (all versions) for Node.js
• Applications and build tools that depend on ansi-html as a dependency
• WebJars npm packages containing ansi-html (org.webjars.npm)

Discovery Timeline

• 2021-08-18 - CVE-2021-23424 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-23424

Vulnerability Analysis

This vulnerability is classified as an Algorithmic Complexity Attack, a type of Denial of Service where inefficient processing of input leads to excessive resource consumption. The ansi-html package processes ANSI escape codes to convert them into HTML markup. However, when handling certain malicious input patterns, the parsing logic enters a state where it consumes disproportionate CPU time relative to the input size.

The vulnerability is particularly concerning because ansi-html is a transitive dependency in many popular development tools and build systems, including webpack-dev-server and other development middleware. This means applications may be vulnerable without directly importing the package.

Root Cause

The root cause lies in the string processing algorithm used to parse ANSI escape sequences. When presented with specially crafted input strings, the parsing logic fails to handle edge cases efficiently, resulting in catastrophic backtracking or excessive loop iterations. This causes the Node.js event loop to block while processing the malicious input, preventing the application from handling other requests or operations.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending a malicious string to any application endpoint that processes user input through the ansi-html library. Common attack scenarios include:

The vulnerability can be triggered when malicious ANSI sequences are passed to the conversion function. An attacker could submit specially crafted terminal output or log data that, when processed by ansi-html, causes the application to hang. Since the package is often used in development servers and logging systems, attackers may target exposed development endpoints or log processing pipelines.

The attack does not require authentication and can be performed remotely over the network. The malicious payload causes the vulnerable function to enter a computationally expensive loop, consuming CPU resources and blocking the application's event loop until processing completes—which may take an impractically long time.

Detection Methods for CVE-2021-23424

Indicators of Compromise

• Unexpected CPU spikes in Node.js processes that correlate with incoming requests
• Application hangs or timeouts when processing specific user-supplied strings containing ANSI-like sequences
• Event loop blocking detected through Node.js monitoring tools
• Increased response times or complete unresponsiveness from services using ansi-html

Detection Strategies

• Implement Software Composition Analysis (SCA) tools to identify ansi-html in your dependency tree using npm ls ansi-html or yarn why ansi-html
• Monitor Node.js process metrics for event loop lag exceeding normal thresholds
• Deploy Application Performance Monitoring (APM) tools to detect abnormal request processing times
• Use runtime protection tools to detect and terminate requests with excessive processing duration

Monitoring Recommendations

• Configure alerts for sustained high CPU utilization in Node.js application processes
• Implement request timeout mechanisms at the application and infrastructure layer
• Monitor for patterns of requests containing unusual or malformed ANSI escape sequences
• Enable detailed logging for input processing functions to aid in incident investigation

How to Mitigate CVE-2021-23424

Immediate Actions Required

• Audit your application's dependency tree to determine if ansi-html is present using npm ls ansi-html or equivalent
• Consider replacing ansi-html with actively maintained alternatives such as ansi-to-html
• Implement input validation and sanitization before passing data to ANSI processing functions
• Deploy request timeouts and circuit breakers to limit the impact of DoS attacks

Patch Information

As of the last NVD update, no official patch has been released by the package maintainer. The ansi-html package appears to be unmaintained based on the GitHub Issue Discussion. Organizations should consider migrating to alternative packages that provide similar functionality with active security support.

For additional vulnerability details, refer to the Snyk JS Advisory and Snyk Java Advisory.

Workarounds

• Replace the ansi-html dependency with actively maintained alternatives like ansi-to-html or @nuxtjs/ansi-to-html
• Implement strict input length limits for any data that will be processed by ANSI conversion functions
• Deploy Web Application Firewall (WAF) rules to filter requests containing suspicious ANSI escape patterns
• Isolate ANSI processing to worker threads or separate processes with resource limits and timeouts

# Check if ansi-html is in your dependency tree
npm ls ansi-html

# Replace with an actively maintained alternative
npm uninstall ansi-html
npm install ansi-to-html

# Verify the replacement
npm ls ansi-to-html