Skip to content

Latest commit

 

History

History
21 lines (14 loc) · 2.3 KB

threat-modeling.md

File metadata and controls

21 lines (14 loc) · 2.3 KB

Threat Model Analysis for nikic/fastroute

Threat: Regular Expression Denial of Service (ReDoS)

Description: An attacker crafts specific URI inputs designed to exploit vulnerable regular expressions used in route definitions within FastRoute. These inputs cause the regex engine to consume excessive CPU resources during route matching, leading to a denial of service for legitimate users. The attacker can achieve this by sending specially crafted requests that trigger worst-case scenario execution paths in the regex engine.

Impact:

  • Denial of Service (DoS): Application becomes unresponsive or significantly slow, making it unavailable to legitimate users.
  • Resource Exhaustion: Server resources (CPU) are consumed excessively, potentially impacting other services hosted on the same server or infrastructure. This can lead to infrastructure instability and wider outages.

FastRoute Component Affected: Regex Route Matching (specifically when regular expressions are used in route definitions)

Risk Severity: High

Mitigation Strategies:

  • Prioritize avoiding complex or unnecessary regular expressions in route definitions. Favor static routes or simpler placeholder-based routes whenever feasible.
  • If regular expressions are necessary, meticulously review and rigorously test all regex patterns for ReDoS vulnerabilities. Utilize online regex testers and static analysis tools specifically designed to detect ReDoS weaknesses. Pay close attention to nested quantifiers and overlapping patterns.
  • Implement timeouts for route matching operations within the application. This acts as a safeguard by limiting the maximum time spent on any single route matching attempt, mitigating the impact of a ReDoS attack even if a vulnerable regex exists.
  • Consider alternative routing strategies or libraries if regex-based routing is not strictly essential for the application's core functionality. Evaluate if simpler routing mechanisms can fulfill the requirements without introducing the ReDoS risk.
  • Regularly update the FastRoute library to the latest stable version. While less likely to directly fix ReDoS in user-defined regex, updates may contain general performance improvements in regex handling or security enhancements.