CVE-2016-10540

Vulnerability

Minimatch, a minimal glob matching utility for Node.js, is vulnerable to a Regular Expression Denial of Service (ReDoS) in the minimatch(path, pattern) function. The issue affects versions 3.0.1 and earlier [1][2]. The vulnerability resides in the pattern parameter, where a crafted glob expression can cause catastrophic backtracking in the regular expression engine [2].

Exploitation

An attacker must be able to supply a malicious glob pattern to the minimatch() function, for example via user-controlled input in a web application. The Proof of Concept provided in the advisory uses a long string of backslashes (\) preceded by [! to trigger a denial of service [2]. No authentication or special privileges are required. The attack is performed by calling minimatch("foo", exploit) where exploit is a carefully constructed string [2].

Impact

Successful exploitation leads to a denial of service (DoS) condition. The Node.js process hangs or becomes unresponsive due to excessive CPU consumption from regex backtracking [1][2]. The impact is limited to availability; there is no disclosure of information or code execution.

Mitigation

Update to minimatch version 3.0.2 or later [2]. The fix was released to address the ReDoS vulnerability. No other workarounds are documented in the available references. Users on unmaintained Node.js versions should also upgrade minimatch as part of a broader update strategy [1].