CVE-2022-37599

loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.

Se ha encontrado un fallo de Denegación de Servicio de Expresión Regular (ReDoS) en la función interpolateName en el archivo interpolateName.js en webpack loader-utils 2.0.0 por medio de la variable resourcePath en el archivo interpolateName.js

A flaw was found in the interpolateName function in interpolateName.js in the webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js. This flaw can lead to a regular expression denial of service (ReDoS).

The package loader-utils before 1.4.2, from 2.0.0 and before 2.0.4 as well as versions from 3.0.0 but below 3.2.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the interpolateName function due to insecure usage of regular expressions. Some WordPress plugins and themes use this dependency, however, are not vulnerable to exploitation.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-08-08 CVE Reserved
2022-10-11 CVE Published
2024-06-01 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption
CWE-1333: Inefficient Regular Expression Complexity

CAPEC

References (8)

URL	Tag	Source
https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38	Third Party Advisory
https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83	Third Party Advisory
https://github.com/webpack/loader-utils/issues/211	Issue Tracking

URL	Date	SRC

URL	Date	SRC
https://github.com/webpack/loader-utils/issues/216	2024-02-28

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2	2024-02-28
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ	2024-02-28
https://access.redhat.com/security/cve/CVE-2022-37599	2023-09-05
https://bugzilla.redhat.com/show_bug.cgi?id=2134872	2023-09-05

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Webpack.js Search vendor "Webpack.js"		Loader-utils Search vendor "Webpack.js" for product "Loader-utils"				>= 1.0.0 < 1.4.2 Search vendor "Webpack.js" for product "Loader-utils" and version " >= 1.0.0 < 1.4.2"		-		Affected
Webpack.js Search vendor "Webpack.js"		Loader-utils Search vendor "Webpack.js" for product "Loader-utils"				>= 2.0.0 < 2.0.4 Search vendor "Webpack.js" for product "Loader-utils" and version " >= 2.0.0 < 2.0.4"		-		Affected
Webpack.js Search vendor "Webpack.js"		Loader-utils Search vendor "Webpack.js" for product "Loader-utils"				>= 3.0.0 < 3.2.1 Search vendor "Webpack.js" for product "Loader-utils" and version " >= 3.0.0 < 3.2.1"		-		Affected