Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers
summary
A methodology links module-level regexp flaws to live Node.js servers by finding vulnerable NPM regexes (module deemed vulnerable if a crafted 80,000‑char input takes >5s), building local usage scenarios, and sending staged HTTP header payloads with iterative probing (≤80 requests). The study identifies 25 module vulnerabilities, crafts exploits (exponential and superlinear cases, e.g. a user-agent parser needing ~40 chars for 2s), tests 2,846 websites, and finds 339 vulnerable (11%); defenses observed include header-size limits and simple request-rate checks.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:36Regular Expression Denial of Service (ReDos)
- 2:17Backtracking-based Matching
- 3:59Overview
- 4:59Setup
- 6:52Ethical Considerations
- 7:41Npm Analysis
- 8:56Vulnerable Regular Expressions
- 10:20HTTP-level Payload Creation
- 11:30Input Dependency
- 12:21Websites Analysis
- 13:38Response Time of a Non-Vulnerable Website
- 14:13Phase 3: Response Time of a Vulnerable Website
- 14:51Phase 3: Number of Vulnerable Websites
- 17:16Defenses (2)
- 19:53Dimensioning Payloads
related talks
32mWriting Secure JavaScript Code
43mTotal ReDoS: the dangers of regex in JavaScript
42mThe Node.js Highway: Attacks Are At Full Throttle
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
38mTotal ReDoS: the Dangers of Regex in JavaScript
24mWriting Secure JavaScript
41mLive Hacking: Breaking into Your Web App
33mOffensive Javascript Techniques for Red Teamers