CVE-2024-21503

ReDoS vulnerability in Black prior to 24.3.0 via leading tabs in input.

• CVSS 5.3
• CWE-1333
• Input Validation and Sanitization
• Remote

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.

CVE

CVE-2024-21503

CWE

CWE-1333

CVSS base score

5.3

Published

2024-03-19

OWASP

A10 Insufficient Logging & Monitoring

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Input Validation and Sanitization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Black

Fixed by upgrading

Yes

Solution

Upgrade to version 24.3.0 or later.

def lines_with_leading_tabs_expanded(input_string):
    lines = input_string.splitlines()
    expanded_lines = []

    for line in lines:
        leading_tabs = len(line) - len(line.lstrip('\t'))
        expanded_lines.append('\t' * leading_tabs + line.lstrip('\t'))

    return '\n'.join(expanded_lines)

input_string = "\t" * 10000 + "This is a test line."
result = lines_with_leading_tabs_expanded(input_string)
print(result)

def lines_with_leading_tabs_expanded(input_string):
    max_leading_tabs = 100
    lines = input_string.splitlines()
    expanded_lines = []

    for line in lines:
        leading_tabs = len(line) - len(line.lstrip('\t'))
        if leading_tabs > max_leading_tabs:
            leading_tabs = max_leading_tabs
        expanded_lines.append('\t' * leading_tabs + line.lstrip('\t'))

    return '\n'.join(expanded_lines)

input_string = "\t" * 10000 + "This is a test line."
result = lines_with_leading_tabs_expanded(input_string)
print(result)

payload = "\t" * 10000  # Example payload with a large number of leading tabs

@misc{vaitp:cve202421503,
  title        = {{ReDoS vulnerability in Black prior to 24.3.0 via leading tabs in input.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21503},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21503/}}
}