BaseFortify

Executive Summary

This is a Regular Expression Denial of Service (ReDoS) vulnerability in Mammoth.js versions 1.3.0 through 1.12.2. It occurs in the style map tokeniser (lib/styles/parser/tokeniser.js) where overlapping regex alternatives allow exponential backtracking when parsing maliciously crafted .docx files with unterminated quoted strings containing repeated backslash escapes. This can block the Node.js event loop for extended periods.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for high CPU usage or frozen Node.js processes when processing .docx files with mammoth.js. Check logs for mammoth.convertToHtml() operations on untrusted documents. Use the fixed version 1.12.3 or later and verify the regex in lib/styles/parser/tokeniser.js has been updated.

Useful 0 Not Useful 0

Impact Analysis

If you process untrusted .docx files using affected Mammoth.js versions, an attacker could supply a specially crafted file to freeze your application for minutes to hours. This disrupts service availability and may crash the Node.js process. Applications handling email attachments or user uploads are particularly at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial of service attacks. GDPR requires systems to ensure availability of services, while HIPAA mandates safeguards against disruptions. A ReDoS attack could violate these requirements by degrading or blocking service availability.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade mammoth.js to version 1.12.3 or later to apply the regex fix.
• Disable embedded style map parsing by setting includeEmbeddedStyleMap: false in the library configuration.
• Process untrusted .docx files in a separate thread or worker with a timeout to limit event loop blocking.
• Avoid using mammoth.js with untrusted documents until patched or mitigated.

Useful 0 Not Useful 0