Regular Expression Denial of Service in tarteaucitron.js

Executive Summary

tarteaucitron.js before version 1.37.0 has a regular expression denial of service vulnerability. Attackers can exploit this by providing unescaped cookie names to the cookie.purge function. This can freeze a webpage by causing catastrophic backtracking when a purge button is clicked, either through a malicious cookie from a sibling subdomain or by injecting a purgeBtn element with a specially crafted data-cookie pattern.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect your website for the presence of tarteaucitron.js versions before 1.37.0. Check for cookies with unescaped names or purgeBtn elements with catastrophic-backtracking patterns. Manually test by injecting a purgeBtn element with a long, complex data-cookie pattern to see if it causes page freezing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause webpage freezes or crashes, disrupting user experience. Visitors may be unable to interact with the site if the purge button is clicked or if malicious cookies are present. It primarily affects websites using vulnerable versions of tarteaucitron.js for cookie consent management.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance by disrupting website functionality, potentially leading to violations of availability requirements in GDPR or HIPAA. Unavailable websites could fail to provide timely access to data or services, which may be considered a compliance failure depending on context.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update tarteaucitron.js to version 1.37.0 or later. Remove any existing cookies with unescaped names and sanitize cookie inputs. Monitor for suspicious purgeBtn elements or patterns in your web pages.

Useful 0 Not Useful 0