CVE-2020-28493

ReDoS vulnerability in jinja2 regex

• CVSS 5.3
• CWE-400 Uncontrolled Resource Consumption
• Input Validation and Sanitization
• Remote

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

CVE

CVE-2020-28493

CWE

CWE-400 Uncontrolled Resource Consumption

CVSS base score

5.3

Published

2021-02-01

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Upgrade to Jinja2 2.11.3 or higher.

from jinja2 import Environment, Markup

def urlize(text):
    
    import re
    
    _punctuation_re = re.compile(r'[\w]+[^\w\s]*')

    urls = _punctuation_re.findall(text)
    return Markup(' '.join(urls))

user_input = "Check this out: http://example.com!!!"
output = urlize(user_input)
print(output)

from jinja2 import Environment, Markup
import re
import html

def urlize(text):
    import re
    
    _punctuation_re = re.compile(r'[\w]+[^\w\s]*')
    urls = _punctuation_re.findall(text)
    escaped_urls = [html.escape(url) for url in urls]
    return Markup(' '.join(escaped_urls))

user_input = "Check this out: http://example.com!!!"
output = urlize(user_input)
print(output)

@misc{vaitp:cve202028493,
  title        = {{ReDoS vulnerability in jinja2 regex}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-28493},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-28493/}}
}