Regular Expression Denial of Service in postcss

The core of this vulnerability lies in the Regular Expression Denial of Service (ReDoS) potential. ReDoS vulnerabilities occur when a regular expression, designed to match a specific pattern, takes an unexpectedly long time to complete due to its complexity and the input provided. In this case, the regex \/\\s sourceMappingURL=(.)\\/ within PostCSS is susceptible. A malicious actor can craft a CSS file containing numerous instances of this pattern, forcing the getAnnotationURL() and loadAnnotation() functions to spend excessive CPU cycles attempting to match the regex. This can lead to a denial of service, rendering the PostCSS processor unresponsive and potentially impacting applications that rely on it for CSS processing.

Projects and applications that rely on PostCSS for CSS processing, particularly those using versions prior to 8.2.13, are at risk. This includes web development teams, build systems utilizing PostCSS, and any application that dynamically processes CSS files. Shared hosting environments where multiple users share the same PostCSS instance are also at increased risk, as a malicious user could potentially impact other users on the same server.

• nodejs / server:

  ps aux | grep postcss | grep -v grep | awk '{print $2}' | xargs -n 1 ps -o %cpu,pid -p

• nodejs / server:

  journalctl -u node -f | grep -i "regex"  # Look for regex-related errors

• generic web: Inspect access logs for unusually large POST requests containing CSS content. Look for patterns resembling the vulnerable regex in the CSS payload.

1. 2021-12-16Discovery

   discovery

2. 2022-01-07Disclosure

   disclosure

3. 2022-01-07PoC

   poc

4. 2022-01-07Patch

   patch

1. Gereserveerd2021-01-08
2. Gepubliceerd2022-01-07
3. Gewijzigd2025-01-14
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2021-23382 is to upgrade PostCSS to version 8.2.13 or later. This version contains a fix that addresses the vulnerable regular expression. If an immediate upgrade is not feasible, consider implementing a temporary workaround by validating CSS files before processing them with PostCSS. This could involve limiting the size of CSS files or implementing a basic regex check to identify potentially malicious patterns. Web Application Firewalls (WAFs) configured to detect and block requests containing suspicious CSS content could also provide a layer of protection. Monitor CPU usage on systems running PostCSS to detect potential ReDoS attacks.

Laatste update

8.5.15recent