Executive brief
Foreman is a proxy management tool for Node.js applications. An attacker can cause the application to become unresponsive by sending specially crafted HTTP requests with malicious paths that trigger excessive regular expression processing, effectively taking the service offline.
Technical details
This vulnerability is a Regular Expression Denial of Service (ReDoS) weakness in foreman's URL path parsing logic. The vulnerable code is located in the forward.js file at line 30, where a regex pattern matching HTTP URLs is executed against user-supplied request paths without proper input validation or catastrophic backtracking prevention. An unauthenticated attacker can send a specially crafted path to a foreman instance to trigger exponential regex matching behavior. The impact results in complete denial of service as the application consumes CPU resources and becomes unable to process legitimate requests. Versions prior to 3.0.1 are affected; upgrading to 3.0.1 or later resolves the issue.
Affected products
- StrongLoop foreman all versions before 3.0.1
Timeline
- 2019-05-31: disclosed
- 2019-05-31: patched: Fixed in version 3.0.1