Executive brief
uap-core is a library used to parse and identify user agent strings in web requests. A regular expression vulnerability allows attackers to craft malicious User-Agent headers that cause the parser to consume excessive CPU and hang, disrupting service availability for all users of affected applications.
Technical details
The vulnerability is a regular expression denial of service (REDoS) attack caused by overlapping capture groups in regex patterns used to parse User-Agent headers. An attacker can send HTTP requests with specially crafted long User-Agent strings to trigger catastrophic backtracking in the regex engine. This is a network-accessible vulnerability requiring no authentication or user interaction. Successful exploitation results in CPU exhaustion and denial of service. The fix is available in uap-core version 0.11.0 and later.
Affected products
- ua-parser uap-core <0.11.0
Timeline
- 2021-01-30: disclosed
- 2021-02-02: patched: Version 0.11.0 released