Lucene search

K
hackeroneOoooooo_qH1:2012135
HistoryJun 04, 2023 - 8:02 a.m.

Internet Bug Bounty: [CVE-2023-22799] Possible ReDoS based DoS vulnerability in GlobalID

2023-06-0408:02:09
ooooooo_q
hackerone.com
$480
20
internet bug bounty
cve-2023-22799
dos vulnerability
globalid
regular expression
activejob
graphql ruby
user input

0.001 Low

EPSS

Percentile

33.8%

I made a report and patch at https://hackerone.com/reports/1696752.

https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127
> There is a possible DoS vulnerability in the model name parsing section of the GlobalID gem. Carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

Impact

ReDoS occurs in Global ID uri parsing.
Global ID is supposed to be used in ActiveJob, but it is also used in libraries such as GraphQL Ruby and uses user input.