CVE-2024-4067

MEDIUM EPSS 69.7%
Published May 14, 20242y ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published May 14, 2024 2y ago
Last Modified Jun 17, 2026 2w ago

Description

The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability Low

Threat Intelligence

EPSS Exploit Probability
69.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-1333

Affected Products 1

VendorProductVersionRange
jonschlinkertmicromatch* <4.0.8

References 8

  • advisory.checkmarx.net https://advisory.checkmarx.net/advisory/CVE-2024-4067/
    ExploitThird Party Advisory
  • devhub.checkmarx.com https://devhub.checkmarx.com/cve-details/CVE-2024-4067/
    Third Party Advisory
  • github.com https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448
    Product
  • github.com https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
    Patch
  • github.com https://github.com/micromatch/micromatch/issues/243
    Issue Tracking
  • github.com https://github.com/micromatch/micromatch/pull/247
    Issue TrackingPatch
  • github.com https://github.com/micromatch/micromatch/pull/266
    Issue TrackingPatch
  • github.com https://github.com/micromatch/micromatch/releases/tag/4.0.8
    Release Notes

Remediation

  • github.com https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
    Patch
  • github.com https://github.com/micromatch/micromatch/pull/247
    Issue TrackingPatch
  • github.com https://github.com/micromatch/micromatch/pull/266
    Issue TrackingPatch