ReDoS vulnerabilities grow and detection tools often disagree
An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools
Cryptography and Security
Summary
ReDoS vulnerabilities happen when a special search pattern called a regex takes a very long time to check bad input, causing websites or services to slow down or stop. The authors studied several tools that try to find these slow regexes and found that the tools often disagree about which ones are risky. They also looked at real cases from a security database and found that ReDoS problems are becoming more common and are more likely to be attacked than other problems. This shows that spotting these vulnerabilities is important but still challenging.
What this means in practice
- •For software security teams: Improve security testing by knowing which regex detection tools may miss or wrongly flag ReDoS vulnerabilities.
- •For web developers: Prioritize fixing regex patterns that are more likely to be exploited as identified by ReDoS analysis to reduce denial of service risks.
- •For security product engineers: Create better ReDoS detection and mitigation tools informed by observed disagreements and vulnerability patterns.$Commercial implications: This paper provides insights that enable the development of more accurate ReDoS detection tools for security vendors to offer.
Authors
N'Zolieh Ismaël Mahassadi, Raphaël Khoury, Justin Vallé, Abdelwahab Hamou-Lhadj
Abstract
ReDoS vulnerabilities are a type of denial of service software weakness that occurs when a regex is used to validate user-supplied input. In some cases, the regex matching process can take exponential time, leading to a denial of service. In this study, we examine and compare the effectiveness of five publicly-available regex detection tools, and one regex correction tool, using three datasets. We further perform an empirical analysis of all ReDoS vulnerabilities reported to the NVD database in order to understand how they differ from non-ReDoS vulnerabilities and glean insights about this type of weakness. We find that ReDoS vulnerabilities are becoming more prevalent and are much more likely to be exploited than non-ReDoS vulnerabilities. We further find that detection tools exhibit substantial disagreement on whether or not a given regex is vulnerable.