VAITP Dataset

← Back to the dataset

CVE-2021-26813

markdown2 < 2.4.0 regex DoS vulnerability

  • CVSS 7.5
  • CWE-1333
  • Input Validation and Sanitization
  • Remote

markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.

CVE
CVE-2021-26813
CWE
CWE-1333
CVSS base score
7.5
Published
2021-03-03
OWASP
A06 Vulnerable and Outdated Components
Orthogonal defect classification
Function
Code defect classification
Incorrect Functionality
Category
Input Validation and Sanitization
Subcategory
Insecure Parsing or Deserialization
Accessibility scope
Remote
Impact
Denial of Service (DoS)
Fixed by upgrading
Yes

Solution

Update markdown2 to version 2.4.0 or higher.

Vulnerable code sample

import re
import markdown2

def markdown_processing(input_string):
    regex = r"(\*\*|__)(.*?)\1"
    if re.search(regex, input_string):
        return markdown2.markdown(input_string)
    return input_string

string = "**" + "a" * 10000 + "**"
print(markdown_processing(string))

Patched code sample

import html
import markdown2

def process_markdown(self, text: str, 
                     allow_html: bool = False,
                     safe_mode: bool = True) -> str:
    try:
        if not isinstance(text, str):
            raise Exception("Input must be a string")
            
        if len(text) > self.max_size:
            raise Exception(
                f"Input exceeds maximum size of {self.max_size} characters"
            )
            
        if not self._is_safe_pattern(text):
            raise Exception("Input contains potentially dangerous content")
            
        extras = {
            'code-friendly': True,
            'break-on-newline': True,
            'tables': True,
            'header-ids': True,
            'fenced-code-blocks': True
        }
        
        if safe_mode:
            extras['safe-mode'] = True
            
        if not allow_html:
            text = html.escape(text)
            
        result = markdown2.markdown(
            text,
            extras=extras,
            safe_mode=safe_mode
        )
        
        return result
        
    except Exception as e:
        raise Exception(f"Error processing markdown: {str(e)}")

Cite this entry

@misc{vaitp:cve202126813,
  title        = {{markdown2 < 2.4.0 regex DoS vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-26813},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-26813/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::