DerScanner
Home / Vulnerability Database / C-sharp : DOS attack via regular expressions possible
C#

C-sharp : DOS attack via regular expressions possible

Classification

OWASP ASVS
Validation, Sanitization and Encoding
CWE
CWE-400

Overview

The regexp used is from an unreliable source, which can be computationally intensive for some inputs. Regular expression denial of service (ReDOS) attack is possible.

Regular expressions are widely used in applications to validate the user-supplied data. Expressions containing structures like (( )+)+ cause execution of a significant amount of iterations. By inputting a certain type of string an attacker can disrupt the application operation. All implementations of regular expressions have such vulnerabilities.

References

  1. OWASP: Regular expression Denial of Service
  2. Runaway Regular Expressions: Catastrophic Backtracking – regular-expressions.info
  3. saferegex – Tool for testing regular expressions for ReDoS vulnerabilities
  4. CWE-400
  5. CodeQL documentation. Regular expression injection
MEDIUM

DerScanner Severity Score

Do you want to fix C-sharp : DOS attack via regular expressions possible in your application?

See also

C#

C-sharp : JWT: None Algorithm

C#

C-sharp : Insecure data transmission: Database

C#

C-sharp : Only one of method Equals() and GetHashCode() defined