Junglewise Threat Intelligence

CVE-2021-4305: Woorank robots-txt-guard regex denial of service in pattern parsing

CVE-2021-4305 · Severity: low · CVSS 3.1 · Published 2023-01-05

Vendors: npm.

Executive brief

Woorank robots-txt-guard is a library that parses robots.txt files to enforce crawling rules on web servers. An attacker can supply a maliciously crafted pattern argument that triggers catastrophic backtracking in the library's regular expression engine, causing the application to hang or consume excessive CPU resources. This results in a denial of service that impacts the availability of services relying on this library.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw affecting the makePathPattern function in lib/patterns.js. When processing user-supplied pattern input, the function constructs a regex with nested quantifiers that exhibit exponential time complexity (CWE-1333: Inefficient Regular Expression Complexity). For example, a pattern like "**/*.js

quot; becomes a regex with repeated "(?:.*)" groups that cause catastrophic backtracking when matching fails. The vulnerability is triggered during pattern compilation and does not require authentication or user interaction beyond supplying a malicious robots.txt pattern. An attacker can cause CPU exhaustion and service unavailability. The issue was fixed in version 1.0.2 via commit c03827cd2f9933619c23894ce7c98401ea824020.

Affected products

  • Woorank robots-txt-guard before 1.0.2

Timeline

  • 2023-01-05: disclosed: Public disclosure via GitHub Advisory
  • 2021-02-07: patched: Fix merged in pull request #4 (commit c03827cd2f9933619c23894ce7c98401ea824020)
  • 2023-01-05: advisory: GHSA-6g33-8w2q-4hxv published; CVE-2021-4305 assigned

References