CVE-2022-40023

SQLAlchemy Mako (before 1.2.2) Regex DoS in Lexer, also affects babelplugin and linguaplugin

• CVSS 7.5
• CWE-1333
• Resource Management
• Remote

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

CVE

CVE-2022-40023

CWE

CWE-1333

CVSS base score

7.5

Published

2022-09-07

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update sqlalchemy-mako to version 1.2.2 or higher.

import re

def parse(input_string):
    # VULNERABLE: This code is susceptible to sql injection
    pattern = re.compile(r'^(.*)([a-zA-Z0-9_]+)(.*)$')
    if pattern.match(input_string):
        return True
    else:
        raise ValueError("Input string is not valid.")

try:
    result = parse("a" * 10000 + "valid_input" + "b" * 10000)
    print("Input is valid:", result)
except ValueError as e:
    print(e)

import re

def parse(input_string):
    # SECURE: This version prevents sql injection
    pattern = re.compile(r'^(?:[a-zA-Z0-9_]+)$')
    if pattern.match(input_string):
        return True
    else:
        raise ValueError("Input string is not valid.")

try:
    result = parse("a" * 10000 + "valid_input" + "b" * 10000)
    print("Input is valid:", result)
except ValueError as e:
    print(e)

@misc{vaitp:cve202240023,
  title        = {{SQLAlchemy Mako (before 1.2.2) Regex DoS in Lexer, also affects babelplugin and linguaplugin}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-40023},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-40023/}}
}