CVE-2021-21317

Regex DoS vulnerability in uap-core < 0.11.0

• CVSS 5.3
• CWE-1333
• Input Validation and Sanitization
• Remote

uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.

CVE

CVE-2021-21317

CWE

CWE-1333

CVSS base score

5.3

Published

2021-02-16

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update uap-core to version 0.11.0 or higher.

import re

pattern = re.compile(r'^(?P<group1>a+)(?P<group2>a+)$')

def parse_user_agent(user_agent):
    match = pattern.match(user_agent)
    if match:
        return match.groupdict()
    return None

user_agent_vulnerable = 'a' * 1000
result_vulnerable = parse_user_agent(user_agent_vulnerable)

import re

pattern = re.compile(r'^(?P<group1>a{1,500})(?P<group2>a{1,500})$')

def parse_user_agent(user_agent):
    if len(user_agent) > 1000:
        return None

    match = pattern.match(user_agent)
    if match:
        return match.groupdict()
    return None

user_agent_vulnerable = 'a' * 1000
result_vulnerable = parse_user_agent(user_agent_vulnerable)

@misc{vaitp:cve202121317,
  title        = {{Regex DoS vulnerability in uap-core < 0.11.0}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-21317},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-21317/}}
}