CVE-2022-43358

What it actually does

Stack-based buffer overflow in Sass::ComplexSelector::has_placeholder within ast_selectors.cpp of libsass, triggered during parsing of complex selectors containing placeholders, resulting in denial of service via process crash.

Why it matters to the business

Applications or build pipelines relying on libsass for CSS/Sass processing can be crashed remotely or via local files, leading to service outages, interrupted deployments, and potential resource exhaustion in affected environments.

How an attack unfolds

An attacker supplies a specially crafted Sass file or input containing a malformed complex selector designed to overflow the stack during placeholder checks in has_placeholder; with public exploits available, this can be delivered via web uploads, build systems, or direct library calls to induce crashes without authentication.

How to fix it

Upgrade libsass to a version containing a fix for the stack overflow in has_placeholder once released; in the interim, implement input validation and sanitization on Sass/CSS content before processing, or switch to alternative Sass compilers such as Dart Sass that are not affected.

How to confirm the fix worked

Test affected applications by feeding crafted selectors known to trigger has_placeholder overflow and confirm absence of crashes after updates; monitor library version strings in build outputs or runtime dependencies to verify patched releases.

Typical attack path

1. Identify target application or service that invokes libsass for stylesheet compilation or processing
2. Craft malicious input containing a complex selector with placeholders that triggers the overflow in ast_selectors.cpp
3. Deliver the input through accepted channels such as file upload, build artifact, or API request
4. Trigger parsing to cause stack overflow and application crash

How to detect it

Review application and system logs for unexpected crashes or segmentation faults in processes linked to libsass; search build logs or error reports for references to ast_selectors.cpp or ComplexSelector parsing failures around the time of suspected incidents.

What your security team should do

• Prioritize replacement of libsass with a maintained alternative due to absence of fixed versions and available exploits
• Add runtime monitoring for crashes in processes using libsass
• Restrict untrusted Sass input sources in build and runtime pipelines
• Track upstream libsass project for security patches and update dependency manifests accordingly