Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerable Regular Expression #5

Open
cristianstaicu opened this issue Sep 5, 2017 · 4 comments
Open

Vulnerable Regular Expression #5

cristianstaicu opened this issue Sep 5, 2017 · 4 comments

Comments

@cristianstaicu
Copy link

The following regular expression introduced for validating the hostname is vulnerable to ReDoS:

/^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]).)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9-]*[A-Za-z0-9])$/

The slowdown is very serious: for 40 characters around 5 seconds matching time. I would suggest one of the following:

  • remove the regex,
  • limit the number of characters that can be matched by the repetition,
  • limit the input size.

Moreover, the regular expression allows validation bypassing and hence arbitrary command execution!!!

If needed, I can provide an actual example showing the slowdown or the validation bypass.

@skoranga
Copy link
Owner

@cristianstaicu, thanks for sharing the concern. Yes can you share the example. I can bake it as a test case.

@evilpacket
Copy link

@cristianstaicu did you provide @skoranga with a proof of concept yet?

@huntr-helper
Copy link

‎‍🛠️ A fix has been provided for this issue. Please reference: 418sec#1

🔥 This fix has been provided through the https://huntr.dev/ bug bounty platform.

@evilpacket
Copy link

Would it be possible to get a security advisory created for this? Only maintainers on the repo can draft it otherwise I'd help. Instructions can be found here https://docs.github.com/en/github/managing-security-vulnerabilities/creating-a-security-advisory

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants