CVE-2021-32723

Regular Expression Denial of Service (ReDoS) in Prism

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

Prism es una biblioteca de resaltado de sintaxis. Algunos lenguajes anteriores a la versión 1.24.0, son vulnerables a una Denegación de Servicio por Expresiones Regulares (ReDoS). Cuando Prism es usado para resaltar texto no confiable (dado por el usuario), un atacante puede diseñar una cadena que tardará mucho tiempo en ser resaltada. Este problema ha sido corregido en Prism versión v1.24. Como solución alternativa , no utilice ASCIIDoc o ERB para resaltar texto no confiable. Otros lenguajes no están afectados y pueden ser usados para resaltar texto no confiable

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-05-12 CVE Reserved
2021-06-28 CVE Published
2024-03-13 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (4)

URL	Tag	Source
https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/PrismJS/prism/pull/2688	2022-03-28
https://github.com/PrismJS/prism/pull/2774	2022-03-28
https://www.oracle.com/security-alerts/cpujan2022.html	2022-03-28

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Prismjs Search vendor "Prismjs"		Prism Search vendor "Prismjs" for product "Prism"				< 1.24.0 Search vendor "Prismjs" for product "Prism" and version " < 1.24.0"		node.js		Affected
Oracle Search vendor "Oracle"		Application Express Search vendor "Oracle" for product "Application Express"				< 21.1.4 Search vendor "Oracle" for product "Application Express" and version " < 21.1.4"		-		Affected