Unitech pm2 Regular Expression Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Unitech pm2 versions through 6.0.6. The issue arises from an inefficient regular expression in the file '/lib/tools/Config.js', which can be exploited remotely. This vulnerability causes excessive CPU usage, potentially leading to application freezing or a denial-of-service condition.

Impact

Exploitation of this vulnerability causes high CPU usage, application freezing, or a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a specially crafted input string that exploits the inefficient regular expression handling in the 'Config.js' file. This can be done by using the pm2 application and inputting the malicious string in a way that triggers the vulnerable regular expression validation.