CVE-2024-21538: cross-spawn ReDoS DOS Vulnerability

CVE-2024-21538 Overview

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Critical Impact

This vulnerability can cause significant disruption by crashing affected applications through resource exhaustion.

Affected Products

• cross-spawn < 6.0.6
• cross-spawn >= 7.0.0 < 7.0.5
• Not Available

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to Not Available
• Not Available - CVE CVE-2024-21538 assigned
• Not Available - Not Available releases security patch
• 2024-11-08 - CVE CVE-2024-21538 published to NVD
• 2025-05-20 - Last updated in NVD database

Technical Details for CVE-2024-21538

Vulnerability Analysis

The cross-spawn package is susceptible to a Regular Expression Denial of Service (ReDoS) attack, which can lead to excessive resource consumption. This occurs through improper input validation that allows an attacker to craft a string to exploit the regex condition in the affected versions.

Root Cause

The vulnerability arises from the lack of proper input sanitization in regular expression processing, enabling complex input patterns that degrade application performance.

Attack Vector

The vulnerability can be exploited remotely by sending a maliciously crafted string to the application using the cross-spawn package.

// Example exploitation code (sanitized)
const maliciousString = 'a'.repeat(100000);
require('cross-spawn').sync(maliciousString);

Detection Methods for CVE-2024-21538

Indicators of Compromise

• Unusual CPU usage spikes
• Application crashes
• Logged errors related to regular expression processing

Detection Strategies

Security teams should monitor application logs for regex processing errors and high CPU usage patterns that correlate with specific input strings.

Monitoring Recommendations

Implement real-time monitoring on CPU usage and establish alerts for abnormal activity consistent with potential ReDoS attacks.

How to Mitigate CVE-2024-21538

Immediate Actions Required

• Update cross-spawn to versions 6.0.6 or 7.0.5 and above
• Implement input validation to prevent complex strings
• Monitor system performance regularly

Patch Information

Upgrade to the latest patched versions as recommended by security advisories or implement mitigation patches if available.

Workarounds

To mitigate the impact without patching, ensure strict input validation is in place to filter and sanitize potentially malicious strings.

# Configuration example
npm install [email protected]