Executive Summary

The vulnerability exists in ajv (Another JSON Schema Validator) through version 8.17.1 when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation.

An attacker can inject a malicious regular expression pattern combined with crafted input to cause catastrophic backtracking, leading to a Regular Expression Denial of Service (ReDoS). For example, a 31-character payload can cause approximately 44 seconds of CPU blocking, and each additional character doubles the execution time.

This allows an attacker to cause a complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service condition by making the CPU spend excessive time processing maliciously crafted regular expressions.

An attacker can send a single HTTP request with a malicious payload that triggers catastrophic backtracking in the regex engine, resulting in significant CPU blocking and making the affected service unresponsive.

This can disrupt availability of APIs or services that rely on ajv with the $data option enabled for dynamic schema validation.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the ajv library is used with the $data option enabled for dynamic schema validation, especially in APIs processing JSON schemas.

Since the vulnerability is triggered by malicious regex patterns causing ReDoS, monitoring for unusually high CPU usage or long response times on API endpoints using ajv with $data: true can be an indicator.

Specific commands to detect this vulnerability are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling the $data option in ajv if it is not strictly necessary, as this option allows unvalidated regex patterns that lead to ReDoS.

If disabling $data is not possible, carefully validate or sanitize any runtime data used in regex patterns before passing them to ajv.

Additionally, monitor and limit resource usage on affected systems to reduce the impact of potential ReDoS attacks.

Useful 0 Not Useful 0