CVEs-PoC/2021/CVE-2021-23346.md

CVE-2021-23346

Description

This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.

POC

Reference

• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1080633
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1080633
• https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY-1079306
• https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY-1079306
• https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307
• https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307

Github

• https://github.com/engn33r/awesome-redos-security
• https://github.com/yetingli/PoCs