Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-4437

CVE-2021-4437: lambda-middleware Inefficient Regular Expression Complexity vulnerability

3.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-4437
GHSA ID
GHSA-m3f4-957x-m785
EPSS Score
0.07492%
CWE
CWE-1333
Published
2/12/2024
Updated
3/1/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
@lambda-middleware/json-deserializernpm< 1.1.01.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the regex-based MIME type validation in isJsonMimeType. The original regex pattern contained (.++) which creates ambiguity in pattern matching and allows for exponential backtracking on malformed inputs. This was explicitly replaced in the patch (f689404) with a safer string parsing approach, confirming this was the vulnerable component. The CWE-1333 classification and commit message both directly reference regex inefficiency as the issue.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility, w*i** w*s *l*ssi*i** *s pro*l*m*ti*, **s ***n *oun* in ***rt*olom** l*m***-mi**l*w*r* *r*m**u*r* up to *.*.*. *****t** *y t*is issu* is som* unknown *un*tion*lity o* t** *il* p**k***s/json-**s*ri*liz*r/sr*/Json**s*ri*liz*r.ts o* t**

Reasoning

T** vuln*r**ility st*ms *rom t** r***x-**s** MIM* typ* `v*li**tion` in `isJsonMim*Typ*`. T** ori*in*l r***x p*tt*rn *ont*in** (.+\+) w*i** *r**t*s *m*i*uity in p*tt*rn m*t**in* *n* *llows *or *xpon*nti*l ***ktr**kin* on m*l*orm** inputs. T*is w*s *xp