CVE-2020-28501: Regular Expression Denial of Service (ReDoS) in es6-crawler-detect

Background

es6-crawler-detect is an npm package that is used for detecting web crawlers and bots based on their user agent string. It provides a simple and efficient way to identify and handle crawler requests. However, prior to version 3.1.3, the package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This means that an attacker can exploit the package's regular expression pattern matching to cause a denial of service by providing a specially crafted user agent string. The package does not impose any limitation on the length of the user agent string, making it susceptible to excessive backtracking and causing the application to become unresponsive.

Vulnerability Detail

The vulnerability in es6-crawler-detect arises from the lack of user agent string length limitation in the regular expression pattern matching. An attacker can send a maliciously crafted user agent string that triggers excessive backtracking in the regular expression engine. This can lead to a denial of service condition where the application becomes unresponsive and may require manual intervention to recover. The impact of this vulnerability can range from temporary unavailability of the affected application to a complete system outage. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 5.3, indicating a moderate severity level.

npm install es6-crawler-detect@3.1.3

Workaround

If updating the package is not immediately feasible, a temporary workaround can be implemented by manually imposing a limitation on the length of the user agent string in the application's code. This can be done by validating the length of the user agent string before passing it to the es6-crawler-detect package. Here is an example of how this can be done in JavaScript:

const userAgent = req.headers['user-agent'];
if (userAgent.length > MAX_USER_AGENT_LENGTH) {
  // Handle the user agent string length limit
}

In this example, MAX_USER_AGENT_LENGTH is a constant that defines the maximum allowed length of the user agent string. If the length exceeds this limit, appropriate actions can be taken to mitigate the vulnerability.

Conclusion

The es6-crawler-detect package prior to version 3.1.3 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This can be exploited by an attacker to cause a denial of service condition in the affected application. To mitigate this vulnerability, it is recommended to update the package to version 3.1.3 or later. If immediate update is not possible, a temporary workaround can be implemented by imposing a limitation on the length of the user agent string. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for es6-crawler-detect →

FAQ