CVE-2017-16086: ReDoS in ua-parser
Summary
CVE-2017-16086: ReDoS via long UserAgent header in ua-parser. Affects ua-parser versions < 0.3.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ua-parser package is an npm package used for parsing User-Agent strings to extract information about the client's browser, operating system, and device. It is commonly used in web applications to tailor the user experience based on the client's device. However, versions of ua-parser prior to 0.3.6 are vulnerable to a regular expression denial of service (ReDoS) attack when provided with a specially crafted User-Agent header.
Vulnerability Detail
The vulnerability arises from a lack of proper input validation and sanitization in the ua-parser package. An attacker can send a maliciously crafted User-Agent header that triggers a ReDoS attack, causing the parsing process to consume excessive CPU resources and potentially leading to a denial of service. This vulnerability has a high severity rating and is classified under CWE-400.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to replace the usage of ua-parser with the useragent package. Here's an example of how to use useragent to achieve similar functionality:
const useragent = require('useragent');
const userAgentString = req.headers['user-agent'];
const agent = useragent.parse(userAgentString);
console.log(agent.toString());
console.log(agent.os.toString());
console.log(agent.device.toString());
Conclusion
The ua-parser package prior to version 0.3.6 is vulnerable to a ReDoS attack. To mitigate this vulnerability, it is recommended to switch to a different package like useragent or any other functionally equivalent package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ua-parser →
FAQ
This vulnerability can lead to a denial of service (DoS) attack by consuming excessive CPU resources. It can potentially disrupt the availability of the affected application.
No, only versions prior to 0.3.6 are vulnerable to this ReDoS attack. It is recommended to update to the latest version of ua-parser or switch to a different package.
No, there is currently no patch available for this vulnerability. The best course of action is to use a different package like useragent instead of ua-parser.
Yes, this vulnerability can be exploited remotely by sending a specially crafted User-Agent header in the HTTP request.
Yes, an alternative package is useragent. It provides similar functionality and is not vulnerable to this ReDoS attack. You can find it on npm at https://www.npmjs.com/package/useragent.
