Executive brief
find-my-way is a JavaScript router library used in web applications to match HTTP requests to route handlers. A poorly constructed regular expression in the router's path parsing can be exploited through specially crafted URLs with multiparametric segments, causing excessive CPU consumption and making the application unresponsive. This type of attack (ReDoS) can lead to denial of service for legitimate users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) issue classified as CWE-1333. It occurs when a route pattern contains two parameters within a single segment followed by a dash (e.g., /:a-:b-), which causes the route compilation logic to generate an inefficient regular expression with exponential backtracking behavior. An attacker can send crafted HTTP requests matching these patterns to trigger worst-case regex performance, consuming CPU resources and degrading application availability. No privileges or authentication are required to exploit this vulnerability. The issue affects find-my-way versions 5.5.0 through 8.2.1 and version 9.0.0; patches are available in versions 8.2.2 and 9.0.1 or later.
Affected products
- delvedor find-my-way 5.5.0 through 8.2.1; 9.0.0
Timeline
- 2024-09-18: disclosed
- 2024-09-18: patched: v8.2.2 and v9.0.1 released