CVE-2023-45813

Torbot Exponential regex DoS in validate_link

• CVSS 7.5
• CWE-1333 Inefficient Regular Expression Complexity
• Resource Management
• Remote

Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE

CVE-2023-45813

CWE

CWE-1333 Inefficient Regular Expression Complexity

CVSS base score

7.5

Published

2023-10-18

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Torbot to version 4.0.0 or higher.

import validators

def validate_link(url):
    return validators.url(url)

url_to_test = "http://example.com"
if validate_link(url_to_test):
    print("Valid URL")
else:
    print("Invalid URL")

import re

def validate_link(url):
    pattern = re.compile(
        r'^(https?://)?(www\.)?([a-zA-Z0-9-]+(\.[a-zA-Z]{2,})+)(:[0-9]{1,5})?(/.*)?$'
    )
    return bool(pattern.match(url))

url_to_test = "http://example.com"
if validate_link(url_to_test):
    print("Valid URL")
else:
    print("Invalid URL")

@misc{vaitp:cve202345813,
  title        = {{Torbot Exponential regex DoS in validate_link}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-45813},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-45813/}}
}