CVE-2021-32723
📋 TL;DR
CVE-2021-32723 is a Regular Expression Denial of Service (ReDoS) vulnerability in Prism syntax highlighting library versions before 1.24.0. Attackers can craft malicious strings that cause excessive processing time when highlighting untrusted text in ASCIIDoc or ERB languages. This affects any application using vulnerable Prism versions to highlight user-provided content.
💻 Affected Systems
- PrismJS
- Any application using Prism syntax highlighting library
📦 What is this software?
Prism by Prismjs
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service where the application becomes unresponsive due to CPU exhaustion from processing malicious regex patterns, potentially affecting all users.
Likely Case
Degraded performance or temporary unavailability of specific features that highlight user content using affected languages.
If Mitigated
Minimal impact if patched or workarounds implemented; normal operations continue with unaffected languages.
🎯 Exploit Status
Exploitation requires only crafting malicious strings; no authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Prism v1.24.0 and later
Vendor Advisory: https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg
Restart Required: No
Instructions:
1. Update Prism to version 1.24.0 or later. 2. For npm: 'npm update prismjs'. 3. For direct download: replace prism.js/prism.min.js with patched version. 4. Verify update by checking version in file or package.json.
🔧 Temporary Workarounds
Disable vulnerable languages
allRemove or disable ASCIIDoc and ERB language definitions from Prism configuration
Remove 'asciidoc' and 'erb' from Prism language loading configuration
Input validation
allImplement length limits and regex pattern validation for user input before highlighting
🧯 If You Can't Patch
- Implement strict input validation and length limits for user content
- Use alternative syntax highlighting libraries for ASCIIDoc and ERB content
🔍 How to Verify
Check if Vulnerable:
Check Prism version in package.json or prism.js file header; versions <1.24.0 are vulnerableCheck Version:
npm list prismjs (for npm) or grep -i 'version' prism.jsVerify Fix Applied:
Confirm Prism version is 1.24.0 or higher and test highlighting with sample ASCIIDoc/ERB content📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for content highlighting
- High CPU usage spikes when processing user content
Network Indicators:
- Increased response times for pages with syntax highlighting
- Timeout errors on content processing endpoints
SIEM Query:
search for 'prism' AND (cpu_usage > 90% OR response_time > 10s) AND process_name contains 'node' OR 'web'🔗 References
- https://github.com/PrismJS/prism/pull/2688
- https://github.com/PrismJS/prism/pull/2774
- https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://github.com/PrismJS/prism/pull/2688
- https://github.com/PrismJS/prism/pull/2774
- https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg
- https://www.oracle.com/security-alerts/cpujan2022.html
