Executive brief
es6-crawler-detect is a JavaScript library used to detect web crawlers and bots in HTTP requests. A regular expression denial-of-service (ReDoS) vulnerability allows an attacker to send a specially crafted user agent string that causes the library to consume excessive CPU resources, potentially disrupting services that rely on it for bot detection.
Technical details
The vulnerability is a regular expression denial-of-service (ReDoS) issue in the user agent parsing logic of es6-crawler-detect. The root cause is the lack of length validation on user agent strings before they are processed by regex operators, allowing an attacker to craft an extremely long or complex user agent string that triggers catastrophic backtracking in the regular expressions. The attack vector is network-based and requires no authentication or user interaction—an attacker can simply send an HTTP request with a malicious user agent header. An exploit causes the application to hang or consume excessive CPU, leading to denial of service. The vulnerability was fixed in version 3.1.3, which implements time limits and sandboxing to prevent the regex from running indefinitely.
Affected products
- es6-crawler-detect es6-crawler-detect before 3.1.3
Timeline
- 2021-04-13: disclosed
- 2021-02-13: patched: Fix merged in version 3.1.3