Regular Expression Denial of Service Alex Roichman Chief

Regular Expression Denial of Service Alex Roichman Chief Architect, Checkmarx Adar Weidman OWASP Senior Programmer, Checkmarx Israel 2009 Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation http: //www. owasp. org

Agenda < Do. S attack < Regex and Do. S - Re. Do. S < Exploiting Re. Do. S: Why, Where & How < Leveraging Re. Do. S to Web attacks 4 Server-side Re. Do. S 4 Client-side Re. Do. S < Preventing Re. Do. S < Conclusions OWASP

Do. S Attack

Brute-Force Do. S

Sophisticated Do. S < Hurting the weakest link of the system < Application bugs 4 Buffer overflow < Fragmentation of Data Structures 4 Hash Table < Algorithm worst case < Sophisticated Do. S is a new approach 4 It is application oriented 4 Hard to prevent/detect 4 Easy to execute (few request, no botnets) 4 Amount of traffic that is required to overload the server - little OWASP

From Sophisticated Do. S to Regex Do. S

Re. Do. S on the Web

Regular Expressions

Regex engine algorithm

Regex Complexity < In general case the number of different paths is exponential on input length < Regex: ^(a+)+$ < Payload: “aaaa. X” < # of different paths: 16 < Regex worst case is exponential < How many paths we have for “aaaaa. X”: 1024 < And for “aaaaaaaaaa. X”? . . .

Evil Regex Patterns < Regex is called evil if it can be stuck on specially crafted input < Each evil Regex pattern should contain: 4 Grouping construct with repetition 4 Inside the repeated group should appear § Repetition § Alternation with overlapping < Evil Regex pattern examples 1. 2. 3. 4. 5. (a+)+ ([a-z. A-Z]+)* (a|aa)+ (a|a? )+ (. *a){x} | for x > 10 Payload: “aaaaaaaaa. X” OWASP

Real examples of Re. Do. S

Real examples of Re. Do. S

Exploiting Re. Do. S: Why

Exploiting Re. Do. S: How

Exploiting Re. Do. S: Where

Web application Re. Do. S – Regex validations

Web application Re. Do. S – malicious inputs

Web application Re. Do. S – attack 1