CVE-2023-23925

High

Description

Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS). This issue has been patched in version 3.1.4. As a workaround, avoid using Strategy settings that use REGEX in conjunction with EXIST and NOT_EXIST operations.

SeverityHigh

CVSS8.6

Exploit probability—

ProductSwitcherapi Switcher Client

PublishedFeb 3, 2023

First seenFeb 3, 2023

Weakness typeCWE-1333CWE-1333 CWE-400Uncontrolled resource consumption

How to fix

Update

switcherapi switcher_client3.1.4 or later
switcher-client3.1.4 or later

Affected products

Product	Affected versions	Fixed in
switcherapi switcher_client	v < 3.1.4	3.1.4
switcher-clientnpm	v < 3.1.4	3.1.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.