CVE-2021-32723 Regular Expression Denial of Service (ReDoS) in Prism
Attackers can cause denial of service in Prism syntax highlighting library by crafting malicious strings for specific languages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-32723?
CVE-2021-32723 is a high-severity denial of service vulnerability in PrismJS prism, published on 28 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.
Weakness: CWE-400
Which versions are affected by CVE-2021-32723?
2 open source packages ship an affected version, including prismjs. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
prismjs npm | All versions | 1.24.0 |
prismjs npm | All versions | 1.24.0 |
Products include Oracle Application Express, Prismjs Prism.
How do I fix CVE-2021-32723?
Upgrade prismjs to 1.24.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-32723 being exploited?
There is no known exploitation of CVE-2021-32723 in the wild and no public exploit code.
Other vulnerabilities in PrismJS prism
Sources
Also known as GHSA-gj77-59wh-66hg, ROOT-APP-NPM-CVE-2021-32723, UBUNTU-CVE-2021-32723.