CVE-2018-3738

Vulnerability

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the protobufjs library, specifically within the parsing logic for .proto files. The issue resides in the parse.js file, where a crafted invalid .proto file can cause the regular expression to exhibit catastrophic backtracking [2]. Affected versions are those prior to 6.8.6 for the 6.x line and prior to 5.0.3 for the 5.x line [1][3].

Exploitation

An attacker can exploit this by providing a specially crafted invalid .proto file to the parser. No special network position or authentication is required if the parser processes untrusted input (e.g., via a web application that allows users to upload .proto files or a service that parses user-supplied protobuf definitions). The attacker's crafted input triggers the ReDoS, causing the parser to consume excessive CPU time.

Impact

Successful exploitation leads to a denial of service (DoS) condition, as the excessive CPU consumption can block the parsing thread, making the application unresponsive and potentially causing a crash or exhaustion of server resources. The confidentiality and integrity of data are not directly compromised [1][3].

Mitigation

The vulnerability has been patched in protobufjs versions 5.0.3 and 6.8.6 [3]. Users should upgrade to at least these versions. If immediate upgrade is not possible, avoid parsing untrusted .proto files with the affected library versions. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing.