Adding ua_parser_js ReDoS Module #9284

nstarke · 2017-12-07T16:36:07Z

"ua-parser-js" is an npm module for parsing browser
user-agent strings. Vulnerable version of this module
have a problematic regular expression that can be exploited
to cause the entire application processing thread to "pause"
as it tries to apply the regular expression to the input.
This is problematic for single-threaded application environments
such as nodejs. The end result is a denial of service
condition for vulnerable applications, where no further
requests can be processed.

Verification

List the steps needed to make sure this thing works

Test application:

// npm i express
// npm i ua-parser-js@0.7.15 (vulnerable)
// npm i ua-parser-js (non-vulnerable)

const express = require('express')
const uaParser = require('ua-parser-js');
const app = express()

app.get('/', (req, res) => {
  var parser = new uaParser(req.headers['user-agent']);
  res.end(JSON.stringify(parser.getResult()));
});

app.listen(3000, '0.0.0.0', () => console.log('Example app listening on port 3000!'))

"ua-parser-js" is an npm module for parsing browser user-agent strings. Vulnerable version of this module have a problematic regular expression that can be exploited to cause the entire application processing thread to "pause" as it tries to apply the regular expression to the input. This is problematic for single-threaded application environments such as nodejs. The end result is a denial of service condition for vulnerable applications, where no further requests can be processed.

wvu · 2017-12-07T17:24:07Z

He's back!

h00die · 2017-12-11T18:07:02Z

do you mind putting some docs together for this module? Template is here

h00die · 2017-12-11T18:13:52Z

Was this reported to the project? I dont see any obvious issues or PRs over there.

h00die · 2017-12-11T18:14:37Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+    super(
+      'Name'           => 'ua-parser-js npm module - Regular Expression Denial of Service',
+      'Description'    => %q{
+        This module exploits a Regular Expression Denial of Service vulnerability in the npm module "ua-parser-js". Server-side applications that use "ua-parser-js" for parsing the browser user-agent string will be vulnerable if they call the "getOS" or "getResult" functions. This vulnerability was fixed as of version 0.7.16.


can you multi-line this please

h00die · 2017-12-11T18:15:52Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+
+  def initialize
+    super(
+      'Name'           => 'ua-parser-js npm module - Regular Expression Denial of Service',


can we shorten this, maybe DoS or REDoS? Maybe also drop the - before the REDoS part as well?

h00die · 2017-12-11T18:16:17Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+      },
+      'References'     =>
+        [
+          ['CWE', '400'],


As per comment in PR, was the project notified of the issue? That would give something to point back to.

h00die · 2017-12-11T18:19:17Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+
+  def test_service_unresponsive
+    begin
+      print_status("Testing for service unresponsiveness.")


trade " for '

h00die · 2017-12-11T18:20:06Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+      })
+
+      if res.nil?
+        print_good("Service not responding.")


no need for interpolation

h00die · 2017-12-11T18:20:23Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+        print_error("Service responded with a valid HTTP Response; ReDoS attack failed.")
+      end
+    rescue ::Rex::ConnectionRefused
+      print_error("An unknown error occurred.")


no need for interpolation

h00die · 2017-12-11T18:20:27Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+    rescue ::Rex::ConnectionRefused
+      print_error("An unknown error occurred.")
+    rescue ::Timeout::Error
+      print_good("HTTP request timed out, most likely the ReDoS attack was successful.")


no need for interpolation

h00die · 2017-12-11T18:20:30Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+
+  def test_service
+    begin
+      print_status("Testing Service to make sure it is working.")


no need for interpolation

h00die · 2017-12-11T18:20:36Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+      })
+
+      if !res.nil? && (res.code == 200 || res.code == 404)
+        print_status("Test request successful, attempting to send payload")


no need for interpolation

h00die · 2017-12-11T18:24:12Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+  end
+
+  def run
+    if !test_service


I believe we prefer unless instead of if !

A few things were changed as per the PR comments: 1) The module title was reworded 2) The module description was multi-lined 3) Negative logic was rewritten to use 'unless' 4) Strings which did not require interpolation were rewritten 5) Documentation markdown was added.

nstarke · 2017-12-11T20:15:02Z

This issue was indeed reported to the project, but it was done privately. I added a link to the commit in the references section.

h00die · 2017-12-13T01:40:16Z

h00die · 2017-12-13T01:45:44Z

Against the test app on ubuntu 16.04 with the vuln code:

Good

msf auxiliary(dos/http/ua_parser_js_redos) > run

[*] Testing Service to make sure it is working.
[*] Test request successful, attempting to send payload
[*] Sending ReDoS request to 192.168.2.137:3000.
[*] No response received from 192.168.2.137:3000, service is most likely unresponsive.
[*] Testing for service unresponsiveness.
[+] Service not responding.
[*] Auxiliary module execution completed

success.

not vuln

msf auxiliary(dos/http/ua_parser_js_redos) > run

[*] Testing Service to make sure it is working.
[*] Test request successful, attempting to send payload
[*] Sending ReDoS request to 192.168.2.137:3000.
[-] Auxiliary aborted due to failure: unknown: ReDoS request unsuccessful. Received status 200 from 192.168.2.137:3000.
[*] Auxiliary module execution completed

success.

python simplehttpserver

msf auxiliary(dos/http/ua_parser_js_redos) > set rport 8000
rport => 8000
msf auxiliary(dos/http/ua_parser_js_redos) > run

[*] Testing Service to make sure it is working.
[*] Test request successful, attempting to send payload
[*] Sending ReDoS request to 192.168.2.137:8000.
[-] Auxiliary aborted due to failure: unknown: ReDoS request unsuccessful. Received status 200 from 192.168.2.137:8000.
[*] Auxiliary module execution completed

success.

h00die · 2017-12-13T01:52:25Z

a few quick changes, and this will be good to go tomorrow!

nstarke · 2017-12-13T12:59:34Z

What changes specifically need to be made at this point? I'm a bit confused. Sorry.

h00die · 2017-12-13T16:33:35Z

I left 2 comments, one about the spaces before => and the other about slightly rearranging the docs

nstarke · 2017-12-13T16:41:20Z

I'm sorry, I don't see the two comments you are referring to anywhere in the pull request. What am I doing wrong? Is there something I need to do in order to be able to see your comments?

h00die · 2017-12-13T16:48:24Z

https://github.com/rapid7/metasploit-framework/pull/9284/files#r156543070
https://github.com/rapid7/metasploit-framework/pull/9284/files#r156544795
https://github.com/rapid7/metasploit-framework/pull/9284/files#r156546529

h00die · 2017-12-13T16:49:17Z

Strange, I had the same thing happen where one tab showed the comments, and another one didn't. Regardless, I linked to the comments. Shouldn't take but 5min, and I'll land in a few hours!

nstarke · 2017-12-13T20:03:09Z

I'm really sorry to sound like a broken record, but I still cannot see the comments you have left. The links you provided don't direct me anywhere in the source tab. I've tried two computers locally and had a colleague on the other side of the country try as well, and we have not been able to see your comments. I'm really not sure what is going on at this point. I apologize for the inconvenience.

h00die · 2017-12-13T20:11:30Z

UGHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH.
my fault.
they're still pending. 2 seconds.

h00die · 2017-12-13T01:23:35Z

documentation/modules/auxiliary/dos/http/ua_parser_js_redos.md

+or `getResult` functions will be vulnerable to this module.  An example server is provided
+below.
+
+```


Lets change this to be more of a 'how to install' to include that example. See https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/scanner/gopher/gopher_gophermap.md#ubuntu-1604-install as an example. All the info is captured here though, just a little re-arranging

h00die · 2017-12-13T01:37:29Z

documentation/modules/auxiliary/dos/http/ua_parser_js_redos.md

+7. Open up a new terminal.
+8. Start msfconsole.
+9. `use auxiliary/dos/http/ua_parser_js_redos`.
+10. `set RHOSTS <IP>`.


rhost not rhosts

h00die · 2017-12-13T01:51:39Z

modules/auxiliary/dos/http/ua_parser_js_redos.rb

+
+  def initialize
+    super(
+      'Name'           => 'ua-parser-js npm module ReDoS',


getting kinda nit picky here but can we tighten up the spaces before the =>? i think 2 or 3 could be removed and everything still spaced out nicely

There were several formatting and layout issues that are fixed in this commit. Also changing `RHOSTS` to `RHOST`.

h00die · 2017-12-14T00:34:59Z

had 2 minor edits: 544e4e3 but just ninja patched it to prevent that from being a hangup.

Thanks for the module, everything looked pretty good from the beginning, so easy land!

h00die · 2017-12-14T00:35:35Z

Release Notes

This PR adds a DoS module against ua_parser_js which is an npm module which has a problematic regex.

nstarke · 2017-12-15T13:57:43Z

Thanks for landing this. As always, it was a pleasure!

h00die added module needs-docs labels Dec 11, 2017

h00die requested changes Dec 11, 2017

View reviewed changes

h00die self-assigned this Dec 11, 2017

h00die added docs and removed needs-docs labels Dec 13, 2017

h00die requested changes Dec 13, 2017

View reviewed changes

Addressing Formatting Issues

dd5532c

There were several formatting and layout issues that are fixed in this commit. Also changing `RHOSTS` to `RHOST`.

h00die approved these changes Dec 14, 2017

View reviewed changes

h00die merged commit dd5532c into rapid7:master Dec 14, 2017

h00die added a commit that referenced this pull request Dec 14, 2017

Land #9284 a regex dos for ua_parser_js npm module

c0a5341

tdoan-r7 added the rn-enhancement release notes enhancement label Dec 20, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding ua_parser_js ReDoS Module #9284

Adding ua_parser_js ReDoS Module #9284

nstarke commented Dec 7, 2017 •

edited by h00die

wvu commented Dec 7, 2017

h00die commented Dec 11, 2017

h00die commented Dec 11, 2017

h00die Dec 11, 2017

h00die Dec 11, 2017

h00die Dec 11, 2017

h00die Dec 11, 2017

h00die Dec 11, 2017

h00die Dec 11, 2017

h00die Dec 11, 2017

h00die Dec 11, 2017

h00die Dec 11, 2017

h00die Dec 11, 2017

nstarke commented Dec 11, 2017

h00die commented Dec 13, 2017

h00die commented Dec 13, 2017

h00die commented Dec 13, 2017

nstarke commented Dec 13, 2017

h00die commented Dec 13, 2017

nstarke commented Dec 13, 2017

h00die commented Dec 13, 2017

h00die commented Dec 13, 2017

nstarke commented Dec 13, 2017

h00die commented Dec 13, 2017

h00die Dec 13, 2017

h00die Dec 13, 2017

h00die Dec 13, 2017

h00die commented Dec 14, 2017

h00die commented Dec 14, 2017

nstarke commented Dec 15, 2017

Adding ua_parser_js ReDoS Module #9284

Adding ua_parser_js ReDoS Module #9284

Conversation

nstarke commented Dec 7, 2017 • edited by h00die

Verification

wvu commented Dec 7, 2017

h00die commented Dec 11, 2017

h00die commented Dec 11, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nstarke commented Dec 11, 2017

h00die commented Dec 13, 2017

h00die commented Dec 13, 2017

Good

not vuln

python simplehttpserver

h00die commented Dec 13, 2017

nstarke commented Dec 13, 2017

h00die commented Dec 13, 2017

nstarke commented Dec 13, 2017

h00die commented Dec 13, 2017

h00die commented Dec 13, 2017

nstarke commented Dec 13, 2017

h00die commented Dec 13, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

h00die commented Dec 14, 2017

h00die commented Dec 14, 2017

Release Notes

nstarke commented Dec 15, 2017

nstarke commented Dec 7, 2017 •

edited by h00die