markdown-it html_re.js redos

Vulnerability

Overview

CVE-2015-10005 describes a Regular Expression Denial of Service (ReDoS) vulnerability in the markdown-it library, affecting versions up to and including 2.x. The flaw resides in an unknown function within the file lib/common/html_re.js, where the manipulation of certain inputs leads to inefficient regular expression complexity [1]. This classification as "problematic" indicates that the issue can degrade performance under specific conditions, potentially causing the library to consume excessive CPU resources when processing crafted input.

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must supply a specially crafted Markdown document to an application using an affected version of markdown-it. Since markdown-it is a parser used in many web applications, blog engines, and content management systems, the attacker may not need any authentication if the application accepts user-supplied Markdown content. The attack vector is network-based, as the crafted payload can be sent via a web form, API endpoint, or any other means by which user input is processed by the parser.

Impact

Successful exploitation results in a denial of service condition. The application could become unresponsive or take an extremely long time to process the malicious input, effectively hanging the server or consuming its resources. While there is no evidence of arbitrary code execution or data exfiltration, the availability impact can be significant for services that rely on markdown-it to render user-generated content.

Mitigation

The vulnerability is fully addressed in markdown-it version 3.0.0, which includes a fix in commit 89c8620157d6e38f9872811620d25138fc9d1b0d [3][4]. Users are strongly advised to upgrade to version 3.0.0 or later. No workarounds have been documented, and the vendor has confirmed that upgrading is the recommended course of action [1].