schema-inspectorproject schema-inspector CVE-2021-21267 in Schema Inspectorproject and NetApp Products
Published on March 19, 2021

Regular Expression Denial-of-Service in npm schema-inspector

product logo product logo
Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation is vulnerable to a denial-of-service attack where some input (for example `a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`) will freeze the program or web browser page executing the code. This affects any current schema-inspector users using any version to validate email addresses. Users who do not do email validation, and instead do other types of validation (like string min or max length, etc), are not affected. Users should upgrade to version 2.0.0, which uses a regex expression that isn't vulnerable to ReDoS.

Github Repository NVD

Vulnerability Analysis

CVE-2021-21267 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Types

What is a Resource Exhaustion Vulnerability?

The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CVE-2021-21267 has been classified to as a Resource Exhaustion vulnerability or weakness.

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.


Products Associated with CVE-2021-21267

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-21267 are published in these products:

Schema Inspectorproject Schema Inspector
 
NetApp Oncommand Insight
 
NetApp E Series Performance Analyzer
 

Affected Versions

schema-inspector Version < 2.0.0 is affected by CVE-2021-21267

Vulnerable Packages

The following package name and versions may be associated with CVE-2021-21267

Package Manager Vulnerable Package Versions Fixed In
npm schema-inspector < 2.0.0 2.0.0

Exploit Probability

EPSS
0.87%
Percentile
74.79%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.