CVE-2021-40897
📋 TL;DR
CVE-2021-40897 is a Regular Expression Denial of Service (ReDoS) vulnerability in split-html-to-chars v1.0.5 that allows attackers to cause denial of service by providing specially crafted invalid HTML input. This affects any application using this vulnerable JavaScript library to parse HTML content.
💻 Affected Systems
- split-html-to-chars
📦 What is this software?
Split Html To Chars by Split Html To Chars Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion from processing malicious HTML input, potentially affecting all users of the application.
Likely Case
Degraded performance or temporary service disruption for users processing HTML content through the vulnerable library.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Exploitation requires sending specially crafted HTML input to applications using the vulnerable library. The PoC demonstrates how to create input that triggers catastrophic backtracking in the regex engine.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.6 or later
Vendor Advisory: https://github.com/yetingli/SaveResults/blob/main/js/split-html-to-chars.js
Restart Required: Yes
Instructions:
1. Update split-html-to-chars to v1.0.6 or later using npm update split-html-to-chars. 2. Restart any Node.js applications using this library. 3. Verify the update by checking package.json or running npm list split-html-to-chars.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject malformed HTML before it reaches the split-html-to-chars library.
Resource Limiting
allConfigure process timeouts and memory limits to prevent complete DoS from regex processing.
// Node.js example: process.setMaxListeners(Infinity); // Increase default limits
// Use --max-old-space-size flag for memory limits
🧯 If You Can't Patch
- Implement WAF rules to block HTML input patterns that trigger ReDoS vulnerabilities
- Rate limit HTML processing endpoints to prevent mass exploitation
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list split-html-to-chars to see if version 1.0.5 is installed.Check Version:
npm list split-html-to-chars | grep split-html-to-charsVerify Fix Applied:
Verify split-html-to-chars version is 1.0.6 or higher using npm list split-html-to-chars.📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for HTML content
- High CPU usage spikes in Node.js processes
- Process crashes or timeouts when handling HTML input
Network Indicators:
- Repeated requests with malformed HTML patterns
- Unusually large HTML payloads to processing endpoints
SIEM Query:
source="application.log" AND ("split-html-to-chars" OR "HTML processing") AND (duration>5000 OR "timeout" OR "CPU spike")