Incorrect Regular Expression in color-string - CVE-2021-29060

Vulnerability identifier: #VU63700

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-29060

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when the application is provided and checks a crafted invalid HWB string. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

color-string
IBM Cloud Pak System
IBM Edge Application Manager
Splunk Enterprise
IBM Security QRadar Analyst Workflow
IBM Process Mining
QRadar User Behavior Analytics

Install update from vendor's website.

color-string - update to 1.6.0
IBM Cloud Pak System - update to 2.3.3.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM Process Mining - update to 1.12.0.4
IBM Security QRadar Analyst Workflow - update to 2.15.1
QRadar User Behavior Analytics - update to 4.1.11

• https://github.com/yetingli/SaveResults/blob/main/js/color-string.js
• https://github.com/yetingli/PoCs/blob/main/CVE-2021-29060/Color-String.md
• https://github.com/Qix-/color-string/commit/0789e21284c33d89ebc4ab4ca6f759b9375ac9d3
• https://www.npmjs.com/package/color-string

• Incorrect Regular Expression in Qix color-string
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow
• Incorrect regular expression in IBM Cloud Pak System
• Incorrect regular expression in IBM Process Mining
• IBM Edge Application Manager update for color-string
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics