CVE-2024-4068
📋 TL;DR
The braces NPM package versions before 3.0.3 contain a memory exhaustion vulnerability where specially crafted input with imbalanced braces causes infinite memory allocation, leading to application crashes. This affects any application using vulnerable versions of the braces library for pattern expansion. Attackers can cause denial of service by sending malicious input to applications that process user-controlled patterns.
💻 Affected Systems
- braces NPM package
📦 What is this software?
Braces by Jonschlinkert
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service causing application crashes and potential service disruption across affected systems, with possible cascading failures in dependent services.
Likely Case
Application crashes and denial of service for affected endpoints, requiring manual restart of services and potential data loss for in-memory operations.
If Mitigated
Minimal impact with proper input validation and memory limits in place, potentially causing degraded performance but preventing complete crashes.
🎯 Exploit Status
Exploitation requires sending specially crafted input with imbalanced braces to applications that process patterns. The vulnerability is simple to trigger with minimal technical knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.3
Vendor Advisory: https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
Restart Required: Yes
Instructions:
1. Update package.json to specify braces version 3.0.3 or higher. 2. Run 'npm update braces' or 'yarn upgrade braces'. 3. Restart all affected applications and services.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement input validation to reject patterns with imbalanced braces before passing to braces library
Memory limit enforcement
allSet Node.js heap memory limits and implement process monitoring to restart on memory exhaustion
node --max-old-space-size=512 your-app.js
🧯 If You Can't Patch
- Implement strict input validation to reject any patterns containing braces that don't have matching pairs
- Deploy rate limiting and WAF rules to block patterns with excessive braces or suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for braces version. Run 'npm list braces' or check node_modules/braces/package.jsonCheck Version:
npm list braces | grep bracesVerify Fix Applied:
Confirm braces version is 3.0.3 or higher. Test with known malicious patterns containing imbalanced braces to ensure no memory exhaustion occurs.📡 Detection & Monitoring
Log Indicators:
- Application crashes with 'JavaScript heap out of memory' errors
- Unusual memory consumption spikes in monitoring
- Repeated application restarts
Network Indicators:
- Patterns with excessive braces in HTTP requests
- Repeated requests with similar malformed patterns
SIEM Query:
source="application.logs" AND ("heap out of memory" OR "FATAL ERROR: Reached heap limit") AND process="node"🔗 References
- https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
- https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
- https://github.com/micromatch/braces/issues/35
- https://github.com/micromatch/braces/pull/37
- https://github.com/micromatch/braces/pull/40
- https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
- https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
- https://github.com/micromatch/braces/issues/35
- https://github.com/micromatch/braces/pull/37
- https://github.com/micromatch/braces/pull/40
