CVE-2023-34109 User input results in Unbounded resource consumption in @zxcvbn-ts/core
Attackers can cause denial of service in Node.js applications by exhausting resources through repeated calls to the zxcvbn function with user inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-34109?
CVE-2023-34109 is a medium-severity denial of service vulnerability in zxcvbn-ts zxcvbn, published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using the second argument of the zxcvbn function. It can result in an unbounded resource consumption as the user inputs array is extended with every function call. Browsers are impacted, too but a single user need to do a lot of input changes so that it affects the browser, while the node process gets the inputs of every user of a platform and can be killed that way. This problem has been patched in version 3.0.2. Users are advised to upgrade. Users unable to upgrade should stop using the second argument of the zxcvbn function and use the zxcvbnOptions.setOptions function.
Weakness: CWE-400
Which versions are affected by CVE-2023-34109?
It affects 1 product.
Products include Zxcvbn-Ts Project Zxcvbn-Ts.
How do I fix CVE-2023-34109?
No fix has been published for CVE-2023-34109 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-34109 being exploited?
There is no known exploitation of CVE-2023-34109 in the wild and no public exploit code.
Sources
Also known as GHSA-38hx-x5hq-5fg4.