Vulnerability DatabaseCVE-2022-31110

CVE-2022-31110:
JavaScript vulnerability analysis and mitigation

Overview

A Denial of Service (DoS) vulnerability was discovered in RSSHub (CVE-2022-31110) affecting versions after 4671720f4c5e1aaaad8fcc1dce684b6546baf2ff and before 5c4177441417b44a6e45c3c63e9eac2504abeb5b. The vulnerability was discovered by Rongrong (@Rongronggg9) and disclosed on June 22, 2022 (GitHub Advisory).

Technical details

The vulnerability is a Regular expression Denial of Service (ReDoS) caused by catastrophic backtracking in user-supplied regular expressions. The issue exists in the filter and filterout parameters which accept user-supplied regular expressions with unconditional trust, then call String.match() to perform regular expression matches. When specially crafted input is provided to these parameters, it can trigger abnormally high CPU usage (GitHub Issue).

Impact

When exploited, the vulnerability causes the RSSHub instance to become unresponsive to any request, with the node process continuously occupying a whole CPU core. This condition can persist for several hours, significantly impacting the performance of servers and RSSHub services (GitHub Advisory).

Mitigation and workarounds

The vulnerability was patched in commit 5c4177441417b44a6e45c3c63e9eac2504abeb5b by replacing the standard RegExp implementation with RE2, a regular expression engine that guarantees linear time matching. Users are advised to update to this or later versions as soon as possible (GitHub Advisory).

Additional resources

Source: This report was generated using AI

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues

Cloud threat landscape

A comprehensive threat intelligence database of cloud security incidents, actors, tools and techniques

PEACH

A step-by-step framework for modeling and improving SaaS and PaaS tenant isolation

Get a personalized demo

Ready to see Wiz in action?

“Best User Experience I have ever seen, provides full visibility to cloud workloads.”

David EstlickCISO

“Wiz provides a single pane of glass to see what is going on in our cloud environments.”

Adam FletcherChief Security Officer

“We know that if Wiz identifies something as critical, it actually is.”

Greg PoniatowskiHead of Threat and Vulnerability Management

Get a demo