Listen to this Post
The default Phalcon MVC router registers a built‑in route compiled to the PCRE pattern ^/([\w0-9\_\-]+)/([\w0-9\.\_]+)(/.)$u. The trailing `(/.)` contains a nested quantifier whose inner group `(/.)` overlaps itself because `.` matches /, and the `/s` (DOTALL) flag is absent. When the regex engine tries to match a subject that ends with a character that `.` cannot consume (e.g., a newline \n), the final anchored `$` fails. To satisfy the pattern, the engine must explore all possible ways to partition the leading run of slashes – roughly `2^(N/2)` partitions for `N` slashes – causing classic catastrophic backtracking. `Phalcon\Mvc\Router::handle()` runs this match on every request using the attacker‑controlled URI. The same construct appears in the `/:params` placeholder expansion and in the CLI router. In default MVC setups, the router reads `$_GET[“_url”]` which PHP URL‑decodes, so a request path containing `%0a%0a` becomes the literal two‑byte string "\n\n". PCRE’s `$` forgives exactly one trailing newline, so two newlines force the match to fail, triggering the exponential explosion. A malicious path of about 40 bytes (e.g., /a/a////////////////////////////////%0a%0a) can burn seconds to minutes of CPU. The provided PoC demonstrates that with `pcre.backtrack_limit` raised to `1e9` and JIT disabled, a 34‑byte URL costs ~5.7 seconds, and 40 bytes reaches minutes. With default settings (backtrack_limit = 1,000,000, JIT on), each request bails after ~1 ms, but that still represents a large CPU amplification – a few hundred concurrent requests saturate a worker pool. Applications using `URI_SOURCE_SERVER_REQUEST_URI` are not reachable via this newline trick, but they remain exposed if other unmatchable tails can be injected. The vulnerability is present in the MVC router, the CLI router, and route compilation for :params.
DailyCVE Form:
Platform: Phalcon PHP
Version: 5.14.2
Vulnerability: Catastrophic Backtracking
Severity: Critical
date: 2026-08-28
Prediction: 2026-09-15
What Undercode Say:
bash commands to test environment:
php -r “echo phpversion(‘phalcon’);”
php -r “echo ini_get(‘pcre.backtrack_limit’);”
php -r “echo ini_get(‘pcre.jit’);”
PoC execution:
REDOS_KS=14,18,22,26,30,34 php poc.php
Curl amplification:
curl -v ‘http://target/a/a////////////////////////////////%0a%0a’
Monitor CPU:
top -p $(pgrep -d’,’ php-fpm)
Exploit: (Educational Purposes!)
Send GET request with path `/a/a////////////////////////////////%0a%0a` (append 26‑28 slashes). If `pcre.jit=0` or `backtrack_limit` raised, single request pins core for seconds. With default limits, flood with hundreds of concurrent such requests to exhaust PHP‑FPM workers.
Protection:
Upgrade Phalcon to patched version. Set `pcre.backtrack_limit` to `1000000` (default). Enable pcre.jit=1. Configure router to use `URI_SOURCE_SERVER_REQUEST_URI` instead of URI_SOURCE_GET_URL. Sanitize/validate request URIs to reject newline characters before routing. Disable default routes and define custom safe routes.
Impact:
Volumetric DoS via CPU amplification (default config) saturating worker pools; single‑packet ReDoS hangs workers outright (JIT off / raised limit); default route silently fails causing mis‑routing/404 errors.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
