Inefficient Regular Expression Complexity in validate_link - TorBot
Summary
CVE-2023-45813: TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link. Affects torbot versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TorBot is an open-source Python package available on PyPI. It is designed to perform various tasks related to Tor, such as scraping websites, interacting with hidden services, and more. The package provides a set of modules and validators to ensure the integrity and security of the data it processes. However, a vulnerability has been discovered in the validate_link function of the torbot.modules.validators module, which uses an inefficient regular expression with exponential complexity for URL validation. This vulnerability can be exploited by an attacker to cause a denial of service or increased resource usage.
Vulnerability Detail
The validate_link function in the torbot.modules.validators module uses the python-validators URL validation regex, which has an exponential complexity. This allows an attacker to craft a malicious URL argument that triggers a significant increase in computation time for the regular expression. By adding a special character at the end of the user argument, the regular expression takes exponentially longer to compute. This can lead to a denial of service condition, as the system becomes unresponsive due to the excessive resource usage. The vulnerability affects versions [0.20, 0.11] of the python-validators library used by TorBot, while version 0.21 seems to be unaffected.
How To Fix
Minimum fixed version
4.0.0
This is the first release that contains the fix.
pip install --upgrade "torbot==4.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the python-validators library is not immediately feasible, a temporary workaround can be implemented by modifying the validate_link function in the torbot.modules.validators module. The regular expression used for URL validation can be replaced with a more efficient and secure implementation. Here is an example of a modified validate_link function:
def validate_link(link):
# Custom URL validation implementation
# ... (code for URL validation)
return True
This workaround ensures that the URL validation is performed using a more efficient and secure method, mitigating the vulnerability.
Conclusion
Inefficient Regular Expression Complexity in validate_link is a vulnerability in the TorBot package that allows an attacker to cause a denial of service or increased resource usage. It can be mitigated by updating the python-validators library to version 0.21 or later. A temporary workaround is available by modifying the validate_link function to use a custom URL validation implementation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for torbot →
FAQ
TorBot is an open-source Python package that provides various functionalities related to Tor, such as web scraping and interacting with hidden services.
The vulnerability allows an attacker to cause a denial of service or increased resource usage by exploiting the inefficient regular expression used for URL validation in TorBot.
Versions [0.20, 0.11] of the python-validators library used by TorBot are vulnerable to this issue.
To fix this vulnerability, update the python-validators library to version 0.21 or later.
Yes, a temporary workaround is to modify the validate_link function in the torbot.modules.validators module to use a custom URL validation implementation.
