Backtracking Regular Expression ReDoS Vulnerability Analysis

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Backtracking regular expressions cause ReDoS 2. Affected Versions: - =0.2.0, <8.0.0 - 8.0.0 3. Fixed Versions: - 0.1.10 - 8.0.0 4. Description: - A bad regular expression is generated whenever you have two parameters in a single route segment, separated by a character that is not a dot (.), for example, . 5. Impact: - Generates a bad regular expression. 6. Patch: - For version 0.1.10, backtracking protection was added when no custom regex is provided. - Version 7.0.0 allows enabling , which throws an error when a regex might be problematic. - Version 8.0.0 removes all features that could lead to ReDoS and stops directly exposing regular expressions. 7. Workarounds: - All versions can be patched by providing a custom regular expression after the first parameter in a single route segment. As long as the custom regex does not match the part before it, you are safe. - If the path cannot be rewritten and the version cannot be upgraded, another option is to limit URL length. 8. Details: - Using generates the regex . This can be exploited with a path like , but TL;DR: the at the end ensures the route never matches, yet due to simple backtracking, it still tries every combination of across the repeated 8,000 segments. - Since JavaScript is single-threaded, regex matching runs on the main thread. Poor performance blocks the event loop, leading to a DoS. In local benchmarking, exploiting the unsafe regex caused performance degradation over 1000x, while the safe regex resulted in ~600ms average latency vs 1ms. This information helps understand the nature, scope of impact, and how to fix or bypass the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Backtracking Regular Expression ReDoS Vulnerability Analysis

More from this source