Listen to this Post
The vulnerability arises when an attacker overrides the serialization of RegExp objects in the Seroval library to inject malicious patterns. During deserialization, these patterns are processed by the JavaScript runtime. If the RegExp pattern is extremely large, it can cause memory exhaustion by allocating excessive heap memory during pattern compilation and matching. Alternatively, patterns engineered for catastrophic backtracking trigger ReDoS (Regular Expression Denial of Service), where the engine enters excessive recursion or looping, consuming high CPU and blocking the event loop. This occurs because Seroval’s default serialization feature trusts and reconstructs RegExp instances from serialized data without adequate safeguards, allowing crafted input to exploit the underlying regex engine’s worst-case complexity.
DailyCVE Form:
Platform: Seroval library
Version: Prior to fix
Vulnerability: RegExp serialization exploit
Severity: Critical
Date: 2024
Prediction: Patch expected soon
What Undercode Say:
Analytics:
Example serialization command triggering memory exhaustion
node -e "const seroval = require('seroval'); const maliciousRegex = { toString: () => 'a'.repeat(1000000) + '.'; }; console.log(seroval.serialize(maliciousRegex));"
Code snippet for ReDoS pattern serialization
const seroval = require('seroval');
const redosPattern = { source: '(a+)+b', flags: 'g' };
const serialized = seroval.serialize(redosPattern);
// Deserialization causes ReDoS
const deserialized = seroval.deserialize(serialized);
How Exploit:
Attackers craft serialized data containing large RegExp patterns or patterns with catastrophic backtracking. When deserialized by Seroval, these patterns are instantiated and can cause memory exhaustion or CPU starvation, leading to denial of service.
Protection from this CVE:
Disable RegExp serialization using the `disabledFeatures` bitmask with `Feature.RegExp` in Seroval’s serialization/deserialization methods.
Impact:
Memory exhaustion crashes the Node.js process, and ReDoS causes prolonged blocking, resulting in application unavailability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
