cyeezy08/DoS-Braces-3.03
PoC files
8 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a Python script (poc_braces_dos.py) that programmatically triggers a denial-of-service vulnerability in the braces npm package (version 3.0.3) by generating a combinatorial explosion via comma-separated brace expansion. It executes Node.js code that calls braces.expand() with a crafted input, measures memory and time consumption, and demonstrates the crash/OOM condition.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README.md and a Python PoC script (poc_braces_dos.py) that demonstrate a denial-of-service vulnerability in the braces npm package. The PoC script installs braces@3.0.3 and runs Node.js code to trigger excessive memory consumption via comma-separated brace expansion. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed. The script's behavior is limited to demonstrating the claimed DoS vulnerability.
Classification basis and observed behavior
Classification basis
The primary artifact is poc_braces_dos.py, which is a script that actively exercises the vulnerability by sending a malicious input to braces.expand() and observing the resulting resource exhaustion. This constitutes exploit code, as it is intended to trigger the vulnerability, not merely detect it.
poc_braces_dos.py:1-7poc_braces_dos.py:64-84Requirements
- Node.js and npm must be installed to run the script and install the vulnerable package.
poc_braces_dos.py:1 - The vulnerable braces package version 3.0.3 must be installed (the script attempts to auto-install it).
poc_braces_dos.py:9-10
Observed behavior
- The script auto-installs braces@3.0.3 if not already present.
poc_braces_dos.py:20-45 - It constructs a malicious input string by repeating the pattern '{a,b}' multiple times (e.g., 22 times for 110 characters).
poc_braces_dos.py:66 - It executes Node.js code that calls braces.expand() with the crafted input, causing the library to materialize millions of items in memory (e.g., 4,194,304 items for n=22).
poc_braces_dos.py:64-84 - It measures and reports the resulting memory consumption (e.g., +1,196,410KB) and execution time (e.g., 9723ms), demonstrating resource exhaustion.
poc_braces_dos.py:88-93 - For larger inputs (n=25), the script reports a TIMEOUT/OOM condition, indicating a successful denial of service.
poc_braces_dos.py:96-98
Behaviors behind the backdoor verdict
Observables
- Command Execution
- npm install braces@3.0.3 --no-saveThe PoC script installs a specific version of the braces package to demonstrate the vulnerability. This is expected for a PoC and does not install unrelated or malicious packages.
poc_braces_dos.py:38 - Code Execution
- node -e <JavaScript code>The PoC script executes Node.js code that calls braces.expand() with crafted input to trigger high memory usage. The executed code is fully visible and limited to the vulnerability demonstration.
poc_braces_dos.py:50-52
What the analysis did not establish
- The evidence packet includes only two text files (README.md and poc_braces_dos.py) out of eight total files in the repository. The other six files (including findings.md, verdict.md, disclosure-report.md, patch.diff, email-draft.txt) are omitted, so their content is unknown.
- The analysis is based solely on the provided text; the code was not executed, and the reported behavior is derived from the script's logic and embedded output examples.
- Six files in the repository were not provided as text content and were not analyzed. Their names and contents are unknown.
- Binary content, if any, was not inspected per the evidence envelope's binary policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.