Regular Expression Denial of Service (ReDoS)

Vulnerability

Overview ua-parser-js before version 0.7.22 is vulnerable to Regular Expression Denial of Service (ReDoS) due to a problematic regex pattern used for matching Redmi Phones and Mi Pad Tablets User-Agent strings. The regex can cause catastrophic backtracking when processing a crafted input, leading to excessive CPU consumption [1][2].

Attack

Vector An attacker can exploit this vulnerability by sending an HTTP request with a specially crafted User-Agent header that matches the pattern but causes the regex to evaluate for an extremely long time. The attacker does not require authentication or a privileged network position; the vulnerability can be triggered remotely by any client sending a request to a server using the affected library to parse User-Agent strings [2][3].

Impact

Successful exploitation results in a Denial of Service (DoS) condition, where the server becomes unresponsive due to CPU exhaustion, potentially causing application downtime. This can affect any application that uses ua-parser-js to parse User-Agent strings, such as web analytics, logging, or device detection services [3][4].

Mitigation

The vulnerability is fixed in ua-parser-js version 0.7.22. Users should upgrade to this version or later. The fix involves modifying the vulnerable regex to prevent catastrophic backtracking. No workarounds are available other than upgrading [1][4].