Listen to this Post
The vulnerability is in the `docloader.ts` file. A regex pattern used to parse HTML `` and `` tags contains nested quantifiers: an outer `+` group wrapping an inner alternation pattern for matching attributes. When this regex processes a malformed tag (e.g., `>), the regex engine enters catastrophic backtracking. The engine exponentially explores every possible way the nested groups could have matched the input string. A small, attacker-controlled HTML payload of around 170 bytes can cause this evaluation to block the Node.js event loop for over 14 seconds, leading to a complete denial of service.
Platform: Fedify
Version: Not specified
Vulnerability : ReDoS
Severity: Critical
date: 2024-04-10
Prediction: 2024-05-10
What Undercode Say:
chmod +x run_poc.sh ./run_poc.sh
const VULNERABLE_REGEX = /<(a|link)((\s+[a-z][a-z:_-]=("[^"]"|'[^']'|[^\s>]+))+)\s\/?>/ig;
function generateMaliciousPayload(repetitions) {
return '<a' + ' a="b"'.repeat(repetitions) + ' ';
}
How Exploit:
Attacker serves malicious HTML.
Victim fetches remote document.
Regex triggers backtracking.
Event loop blocks.
Protection from this CVE
Use DOM parser.
Limit response size.
Refactor vulnerable regex.
Impact:
Remote Denial of Service.
Event Loop Blocking.
Service Unavailability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
