CVE-2021-40899
📋 TL;DR
CVE-2021-40899 is a Regular Expression Denial of Service (ReDoS) vulnerability in repo-git-downloader v0.1.1 that allows attackers to cause excessive CPU consumption and service unavailability by providing specially crafted invalid git repositories. This affects any application or service using the vulnerable version of repo-git-downloader to download git repositories.
💻 Affected Systems
- repo-git-downloader
📦 What is this software?
Repo Git Downloader by Repo Git Downloader Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting dependent services and causing extended downtime.
Likely Case
Degraded performance or temporary service disruption when processing malicious git repository URLs.
If Mitigated
Minimal impact with proper input validation, rate limiting, and monitoring in place.
🎯 Exploit Status
Exploitation requires ability to trigger git repository downloads with malicious input. The vulnerability is in the regular expression pattern matching.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.1.2 or later
Vendor Advisory: https://github.com/yetingli/SaveResults/blob/main/js/repo-git-downloader.js
Restart Required: Yes
Instructions:
1. Update repo-git-downloader to v0.1.2 or later using npm update repo-git-downloader. 2. Restart any services using the library. 3. Verify the update with npm list repo-git-downloader.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation of git repository URLs before passing to repo-git-downloader.
Rate Limiting
allImplement rate limiting on git download endpoints to prevent DoS attacks.
🧯 If You Can't Patch
- Implement WAF rules to block suspicious git repository URLs containing complex patterns.
- Monitor CPU usage and implement automatic throttling when abnormal patterns are detected.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list repo-git-downloader to see if version 0.1.1 is installed.Check Version:
npm list repo-git-downloader | grep repo-git-downloaderVerify Fix Applied:
Verify repo-git-downloader version is 0.1.2 or higher using npm list repo-git-downloader.📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for git downloads
- High CPU usage spikes during repository downloads
- Failed git download requests with malformed URLs
Network Indicators:
- Multiple rapid requests to git download endpoints
- Requests with unusually long or complex git repository URLs
SIEM Query:
source="application.logs" AND ("git-download" OR "repo-git-downloader") AND (duration>10s OR cpu_usage>90)