CVE-2021-43308 : Security Advisory and Response

An exponential ReDoS (Regular Expression Denial of Service) vulnerability has been identified in the markdown-link-extractor npm package, allowing attackers to cause denial of service by supplying arbitrary input to the module's exported function.

Understanding CVE-2021-43308

What is CVE-2021-43308?

This CVE refers to a vulnerability in the markdown-link-extractor npm package that can be exploited to trigger an exponential ReDoS when untrusted input is provided.

The Impact of CVE-2021-43308

This vulnerability has a CVSS base score of 5.9, with high availability impact, under unchanged scope, and no confidentiality or integrity impact. The attack complexity is high, and it requires no user interaction or privileges.

Technical Details of CVE-2021-43308

Vulnerability Description

The vulnerability allows triggering an exponential ReDoS by providing malicious input to the markdown-link-extractor npm package.

Affected Systems and Versions

Affected Versions: Versions lower than 3.0.2
Unaffected Versions: 4.0.1

Exploitation Mechanism

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None

Mitigation and Prevention

Immediate Steps to Take

Update markdown-link-extractor to version 4.0.1 or above.
Avoid untrusted inputs in the module's exported function.

Long-Term Security Practices

Regularly monitor for security advisories related to markdown-link-extractor.
Implement input validation for user-supplied data.

Patching and Updates

Regularly check for updates and security patches for markdown-link-extractor to ensure protection against known vulnerabilities.