High severity · published Mar 19, 2021
CVE-2021-21267
Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector)
7.5
CVSS
2.1%
EPSS
No
On KEV
Description
Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation is vulnerable to a denial-of-service attack where some input (for example `a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`) will freeze the program or web browser page executing the code. This affects any current schema-inspector users using any version to validate email addresses. Users who do not do email validation, and instead do other types of validation (like string min or max length, etc), are not affected. Users should upgrade to version 2.0.0, which uses a regex expression that isn't vulnerable to ReDoS.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
E-series Performance Analyzer · Netapp
All versions, or not specified · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
SC
Schema-inspector · Schema-inspector Project
before 2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21267
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21267
Exploit
https://gist.github.com/mattwelke/b7f42424680a57b8161794ad1737cd8f
Exploit
https://github.com/schema-inspector/schema-inspector/security/advisories/GHSA-f38p-c2gq-4pmr
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210528-0006/
Exploit
https://www.npmjs.com/package/schema-inspector
More from E-series Performance Analyzer
7.8
CVE-2019-13272
Linux Kernel Improper Privilege Management Vulnerability
9.8
CVE-2021-26707
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it
9.8
CVE-2021-23383
Prototype Pollution
9.8
CVE-2021-20231
A flaw was found in gnutls
8.8
CVE-2022-21703
Grafana is an open-source platform for monitoring and observability
