Executive brief
Woorank robots-txt-guard is a library that parses robots.txt files to enforce crawling rules on web servers. An attacker can supply a maliciously crafted pattern argument that triggers catastrophic backtracking in the library's regular expression engine, causing the application to hang or consume excessive CPU resources. This results in a denial of service that impacts the availability of services relying on this library.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw affecting the makePathPattern function in lib/patterns.js. When processing user-supplied pattern input, the function constructs a regex with nested quantifiers that exhibit exponential time complexity (CWE-1333: Inefficient Regular Expression Complexity). For example, a pattern like "**/*.js
quot; becomes a regex with repeated "(?:.*)" groups that cause catastrophic backtracking when matching fails. The vulnerability is triggered during pattern compilation and does not require authentication or user interaction beyond supplying a malicious robots.txt pattern. An attacker can cause CPU exhaustion and service unavailability. The issue was fixed in version 1.0.2 via commit c03827cd2f9933619c23894ce7c98401ea824020.Affected products
- Woorank robots-txt-guard before 1.0.2
Timeline
- 2023-01-05: disclosed: Public disclosure via GitHub Advisory
- 2021-02-07: patched: Fix merged in pull request #4 (commit c03827cd2f9933619c23894ce7c98401ea824020)
- 2023-01-05: advisory: GHSA-6g33-8w2q-4hxv published; CVE-2021-4305 assigned