Code Correctness: Regular Expressions Denial of Service

ABSTRACT

不可信賴數據被傳遞至應用程序并作為正則表達式使用。這會導致線程過度使用 CPU 資源。

實現正則表達式評估程序及相關方法時存在漏洞，該漏洞會導致評估線程在處理嵌套和重復的正則表達式組的重復和交替重疊時掛起。這個缺陷可被攻擊者用于執行 DOS (Denial of Service) 攻擊。
例：


		(e+)+
		([a-zA-Z]+)*
		(e|ee)+

已知的正則表達式實現方法均無法避免這種漏洞。所有平臺和語言都容易受到這種攻擊。

[1] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A9 Application Denial of Service

[2] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP6080 CAT II

[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP6080 CAT II

[4] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 185, CWE ID 730

[5] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) Denial of Service

[6] Bryan Sullivan Regular Expression Denial of Service Attacks and Defenses

[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.9