cvelistv5 - cve-2024-9506

CVE-2024-9506 (GCVE-0-2024-9506)

Vulnerability from cvelistv5 – Published: 2024-10-15 15:40 – Updated: 2024-10-15 16:10

Summary

Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.

Severity ?

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

HeroDevs

References

URL

Tags

https://www.herodevs.com/vulnerability-directory/…

Impacted products

	Vendor	Product	Version
	vue	vue	Affected: 2.0.0 , ≤ 2.7.16 (semver)

Credits

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T16:10:46.075149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T16:10:56.576Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vue",
          "vendor": "vue",
          "versions": [
            {
              "lessThanOrEqual": "2.7.16",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "K"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability."
            }
          ],
          "value": "Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-492",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-492 Regular Expression Exponential Blowup"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T15:40:04.627Z",
        "orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "shortName": "HeroDevs"
      },
      "references": [
        {
          "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-9506"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Regular Expression Denial of Service (ReDoS)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
    "assignerShortName": "HeroDevs",
    "cveId": "CVE-2024-9506",
    "datePublished": "2024-10-15T15:40:04.627Z",
    "dateReserved": "2024-10-03T22:32:46.410Z",
    "dateUpdated": "2024-10-15T16:10:56.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability.\"}, {\"lang\": \"es\", \"value\": \"Una expresi\\u00f3n regular incorrecta en la funci\\u00f3n parseHTML de Vue conduce a una posible vulnerabilidad de denegaci\\u00f3n de servicio de expresi\\u00f3n regular.\"}]",
      "id": "CVE-2024-9506",
      "lastModified": "2024-10-16T16:38:43.170",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"baseScore\": 3.7, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 1.4}]}",
      "published": "2024-10-15T16:15:06.650",
      "references": "[{\"url\": \"https://www.herodevs.com/vulnerability-directory/cve-2024-9506\", \"source\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\"}]",
      "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1333\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-9506\",\"sourceIdentifier\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"published\":\"2024-10-15T16:15:06.650\",\"lastModified\":\"2024-10-16T16:38:43.170\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability.\"},{\"lang\":\"es\",\"value\":\"Una expresi\u00f3n regular incorrecta en la funci\u00f3n parseHTML de Vue conduce a una posible vulnerabilidad de denegaci\u00f3n de servicio de expresi\u00f3n regular.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"references\":[{\"url\":\"https://www.herodevs.com/vulnerability-directory/cve-2024-9506\",\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-9506\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-15T16:10:46.075149Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-15T16:10:50.594Z\"}}], \"cna\": {\"title\": \"Regular Expression Denial of Service (ReDoS)\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"K\"}], \"impacts\": [{\"capecId\": \"CAPEC-492\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-492 Regular Expression Exponential Blowup\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"vue\", \"product\": \"vue\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.7.16\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.herodevs.com/vulnerability-directory/cve-2024-9506\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1333\", \"description\": \"CWE-1333 Inefficient Regular Expression Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"shortName\": \"HeroDevs\", \"dateUpdated\": \"2024-10-15T15:40:04.627Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-9506\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-15T16:10:56.576Z\", \"dateReserved\": \"2024-10-03T22:32:46.410Z\", \"assignerOrgId\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"datePublished\": \"2024-10-15T15:40:04.627Z\", \"assignerShortName\": \"HeroDevs\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-9506

Vulnerability from fkie_nvd - Published: 2024-10-15 16:15 - Updated: 2024-10-16 16:38

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.

References

	URL	Tags
	36c7be3b-2937-45df-85ea-ca7133ea542c	https://www.herodevs.com/vulnerability-directory/cve-2024-9506

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability."
    },
    {
      "lang": "es",
      "value": "Una expresi\u00f3n regular incorrecta en la funci\u00f3n parseHTML de Vue conduce a una posible vulnerabilidad de denegaci\u00f3n de servicio de expresi\u00f3n regular."
    }
  ],
  "id": "CVE-2024-9506",
  "lastModified": "2024-10-16T16:38:43.170",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-10-15T16:15:06.650",
  "references": [
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-9506"
    }
  ],
  "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "type": "Secondary"
    }
  ]
}

GHSA-5J4C-8P2G-V4JX

Vulnerability from github – Published: 2024-10-15 18:30 – Updated: 2024-10-24 18:42

Summary

ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function

Details

The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.

To demonstrate this vulnerability, here's an example. In a Vue client-side application, create a new Vue instance with a template string that includes a <script> tag but closes it incorrectly with something like </textarea>.

new Vue({
  el: '#app',
  template: '
    <div>
      Hello, world!
      <script>${'<'.repeat(1000000)}</textarea>
    </div>'
});

Next, set up a basic HTML page (e.g., index.html) to load this JavaScript and mount the Vue instance:

<!DOCTYPE html>
<html>
<head>
  <title>My first Vue app</title>
</head>
<body>
  <div id=\"app\">Loading...</div>
</body>
</html>

When you visit the app in your browser at http://localhost:3000, you'll notice that the time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.

Severity ?

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

2.9 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-alpha.1"
            },
            {
              "fixed": "3.0.0-alpha.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9506"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-24T18:42:59Z",
    "nvd_published_at": "2024-10-15T16:15:06Z",
    "severity": "LOW"
  },
  "details": "The ReDoS can be exploited through the `parseHTML` function in the `html-parser.ts` file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.\n\nTo demonstrate this vulnerability, here\u0027s an example. In a Vue client-side application, create a new Vue instance with a template string that includes a `\u003cscript\u003e` tag but closes it incorrectly with something like `\u003c/textarea\u003e`.\n\n```javascript\nnew Vue({\n  el: \u0027#app\u0027,\n  template: \u0027\n    \u003cdiv\u003e\n      Hello, world!\n      \u003cscript\u003e${\u0027\u003c\u0027.repeat(1000000)}\u003c/textarea\u003e\n    \u003c/div\u003e\u0027\n});\n```\nNext, set up a basic HTML page (e.g., index.html) to load this JavaScript and mount the Vue instance:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n  \u003ctitle\u003eMy first Vue app\u003c/title\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n  \u003cdiv id=\\\"app\\\"\u003eLoading...\u003c/div\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nWhen you visit the app in your browser at http://localhost:3000, you\u0027ll notice that the time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.",
  "id": "GHSA-5j4c-8p2g-v4jx",
  "modified": "2024-10-24T18:42:59Z",
  "published": "2024-10-15T18:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9506"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vuejs/core"
    },
    {
      "type": "WEB",
      "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-9506"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-9506 (GCVE-0-2024-9506)

FKIE_CVE-2024-9506

GHSA-5J4C-8P2G-V4JX

Tags

Sightings

Nomenclature