CVE-2021-23392: 
JavaScript vulnerability analysis and mitigation

The package locutus before version 2.0.15 contains a Regular Expression Denial of Service (ReDoS) vulnerability identified as CVE-2021-23392. The vulnerability was discovered in the gopher_parsedir function and was disclosed on April 5, 2021, with a patch released on May 27, 2021. The vulnerability affects all versions of the locutus package prior to version 2.0.15 running on Node.js (Snyk Advisory, NVD).

The vulnerability exists in the gopher_parsedir function which uses a vulnerable regular expression pattern for parsing. The original regex pattern /^(.)(.?)\t(.?)\t(.?)\t(.?)\u000d\u000a$/ was susceptible to ReDoS attacks. This was fixed by changing the pattern to /^(.)(^\t)\t(^\t)\t(^\t)\t(^\t)\r\n$/ to prevent catastrophic backtracking. The vulnerability has a CVSS v3.1 base score of 7.5 (HIGH) according to NVD, while Snyk rates it at 5.3 (MEDIUM) (NVD, GitHub Commit).

When exploited, this vulnerability can lead to a Denial of Service condition through excessive CPU consumption. The attack can cause the service to process requests very slowly, with processing time increasing exponentially based on input size. This can result in reduced performance or partial service availability (Snyk Advisory).

The vulnerability can be exploited by sending specially crafted input to the gopher_parsedir function. A proof-of-concept exploit exists that demonstrates how an attacker can trigger the ReDoS condition by creating a string with multiple tab characters. The attack requires no special privileges or user interaction to execute (Snyk Advisory).

The recommended mitigation is to upgrade the locutus package to version 2.0.15 or higher, which contains the security fix. The fix involves modifying the regular expression pattern used in the gopher_parsedir function to prevent catastrophic backtracking (GitHub PR, GitHub Commit).