Papers for

security product engineers

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

ReDoS vulnerabilities grow and detection tools often disagree

An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools

Abstract: ReDoS vulnerabilities are a type of denial of service software weakness that occurs when a regex is used to validate user-supplied input. In some cases, the regex matching process can take exponential time, leading to a denial of service. In this study, we examine and compare the effectiveness of five publicly-available regex detection tools, and one regex correction tool, using three datasets. We further perform an empirical analysis of all ReDoS vulnerabilities reported to the NVD database in order to understand how they differ from non-ReDoS vulnerabilities and glean insights about this type of weakness. We find that ReDoS vulnerabilities are becoming more prevalent and are much more likely to be exploited than non-ReDoS vulnerabilities. We further find that detection tools exhibit substantial disagreement on whether or not a given regex is vulnerable.

Wed 9 SeptCryptography and Security

The gist

ReDoS vulnerabilities happen when a special search pattern called a regex takes a very long time to check bad input, causing websites or services to slow down or stop. The authors studied several tools that try to find these slow regexes and found that the tools often disagree about which ones are risky. They also looked at real cases from a security database and found that ReDoS problems are becoming more common and are more likely to be attacked than other problems. This shows that spotting these vulnerabilities is important but still challenging.

Open → 2609.10294v1