This repository has been archived by the owner on May 14, 2020. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 727
Vulnerable regexp in rule 933160 #1358
Comments
Unlike what you reported on #1359 I'm not able to reproduce the issue. Any help on defining a ReDoS HTTP request that matches 933160? |
theMiddleBlue
added
the
PR available
this issue is referenced by an active pull request
label
Apr 17, 2019
This issue is referenced as CVE-2019-11390 by NIST. This issues is not directly exploitable in CRS / ModSecurity. Tested against ModSecurity 3.0.3 on Nginx 1.3.12.
|
fgsch
changed the title
ReDOS Vulnerability [High] (#4)
Vulnerable regexp in rule 933160
Apr 29, 2019
fgsch
removed
the
PR available
this issue is referenced by an active pull request
label
Oct 21, 2019
Moved to #1494 |
This was referenced May 13, 2020
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
The vulnerable regular expression is located in
/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
on line 337. [Link]The vulnerability is caused by nested repetition operators and can be exploited with the following string
PS: For some reason, I was unable to reproduce it in Python engine but it works perfectly with PHP (Tested via RegexBuddy) and gives a complexity of about 2*n.
The text was updated successfully, but these errors were encountered: