CVE-2024-4067
📋 TL;DR
The NPM package micromatch prior to version 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS) in the braces() function. Attackers can craft malicious input patterns that cause excessive backtracking in regular expression processing, leading to CPU exhaustion and application slowdowns or hangs. This affects any application using vulnerable versions of micromatch for pattern matching.
💻 Affected Systems
- micromatch NPM package
📦 What is this software?
Micromatch by Jonschlinkert
⚠️ Risk & Real-World Impact
Worst Case
Complete application denial of service with sustained high CPU usage causing service unavailability and potential cascading failures in dependent systems.
Likely Case
Degraded application performance with increased response times and intermittent service disruptions affecting user experience.
If Mitigated
Minimal impact with proper input validation, rate limiting, and updated dependencies preventing exploitation.
🎯 Exploit Status
Exploitation requires sending specially crafted pattern strings to vulnerable endpoints. No authentication needed if the vulnerable function processes user input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.8
Vendor Advisory: https://github.com/micromatch/micromatch/releases/tag/4.0.8
Restart Required: Yes
Instructions:
1. Update package.json to specify micromatch version 4.0.8 or higher. 2. Run 'npm update micromatch' or 'npm install micromatch@latest'. 3. Restart the application to load the updated package.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to reject or sanitize patterns containing problematic brace sequences before passing to micromatch.braces()
Rate limiting and timeout enforcement
allImplement request rate limiting and pattern processing timeouts to prevent sustained CPU exhaustion attacks
🧯 If You Can't Patch
- Implement strict input validation to reject patterns with complex brace sequences
- Deploy application-level rate limiting and CPU monitoring to detect and block DoS attempts
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list micromatch' to see installed version. If version is below 4.0.8, the system is vulnerable.Check Version:
npm list micromatch | grep micromatchVerify Fix Applied:
After updating, verify with 'npm list micromatch' showing version 4.0.8 or higher, then test pattern matching functionality.📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for pattern matching operations
- High CPU usage spikes in Node.js processes
- Application timeouts or crashes during pattern processing
Network Indicators:
- Repeated requests with complex pattern strings
- Unusually large pattern payloads in requests
SIEM Query:
source="application.logs" AND ("micromatch" OR "pattern matching") AND (duration>5s OR "timeout" OR "CPU spike")🔗 References
- https://advisory.checkmarx.net/advisory/CVE-2024-4067/
- https://devhub.checkmarx.com/cve-details/CVE-2024-4067/
- https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
- https://github.com/micromatch/micromatch/pull/266
- https://github.com/micromatch/micromatch/releases/tag/4.0.8
- https://devhub.checkmarx.com/cve-details/CVE-2024-4067/
- https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448
- https://github.com/micromatch/micromatch/issues/243
- https://github.com/micromatch/micromatch/pull/247
