CVE-2017-16119: DoS in fresh Command-Line Tool
Platform
nodejs
Component
fresh
Fixed in
0.5.2
CVE-2017-16119 represents a Denial of Service (DoS) vulnerability within the fresh command-line tool. This vulnerability arises from improper handling of user input, specifically when parsing regular expressions. An attacker can exploit this flaw by providing specially crafted input, leading to a denial of service condition, rendering the tool unresponsive. Affected versions include those prior to 0.5.2; an update to version 0.5.2 or later resolves the issue.
Impact and Attack Scenarios
The primary impact of CVE-2017-16119 is a denial of service. An attacker can craft malicious input designed to trigger an excessive resource consumption within the fresh tool's regular expression engine. This can lead to the tool becoming unresponsive, preventing legitimate users from utilizing it. The blast radius is limited to the system running the fresh tool, but repeated or widespread exploitation could impact multiple systems if the tool is deployed across an organization. While not directly leading to data exfiltration, the disruption of service can significantly impact workflows and productivity.
Exploitation Context
CVE-2017-16119 has been publicly disclosed and a proof-of-concept (POC) is likely available, though no active campaigns have been definitively linked to this specific vulnerability. Its CVSS score of 7.5 (HIGH) indicates a significant potential for exploitation. The vulnerability was published on July 24, 2018. While not listed on KEV or EPSS, the ease of exploitation associated with regular expression DoS vulnerabilities warrants careful attention and prompt remediation.
Threat Intelligence
Exploit Status
EPSS
0.33% (56% percentile)
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- None — no confidentiality impact. Attacker cannot read protected data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Timeline
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The recommended mitigation for CVE-2017-16119 is to immediately upgrade to version 0.5.2 or later of the fresh tool. If upgrading is not immediately feasible due to compatibility concerns or system downtime constraints, consider implementing input validation to sanitize user-provided data before it is processed by the regular expression engine. This could involve limiting the complexity of allowed regular expressions or employing a whitelist approach to permitted input patterns. There are no specific WAF or proxy rules applicable to this vulnerability as it resides within the application itself. After upgrading, confirm the fix by attempting to process a known malicious input string and verifying that the tool remains responsive.
How to fix
No official patch available. Check for workarounds or monitor for updates.
Frequently asked questions
What is CVE-2017-16119 — DoS in fresh Command-Line Tool?
CVE-2017-16119 is a denial-of-service vulnerability in the fresh command-line tool. Specially crafted user input can trigger a regular expression denial of service, causing the tool to become unresponsive.
Am I affected by CVE-2017-16119 in fresh Command-Line Tool?
You are affected if you are using a version of fresh prior to 0.5.2. Check your version using fresh --version.
How do I fix CVE-2017-16119 in fresh Command-Line Tool?
Upgrade to version 0.5.2 or later of fresh. This resolves the regular expression denial of service vulnerability.
Is CVE-2017-16119 being actively exploited?
While no active campaigns have been definitively linked, the vulnerability is publicly disclosed and a POC is likely available, warranting prompt remediation.
Where can I find the official fresh advisory for CVE-2017-16119?
Refer to the project's release notes or repository for information regarding the fix. Search for 'fresh 0.5.2 release notes' for details.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...