5

CVSS Score

Basic Information

CVE ID

CVE-2017-16030

GHSA ID

GHSA-pjmx-9xr3-82qr

EPSS Score

0.55097%

CWE

CWE-400

Published

7/24/2018

Updated

9/6/2023

KEV Status

Technology

JavaScript

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2017-16030

CVE-2017-16030: ReDoS via long UserAgent header in useragent

Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed.

Proof of Concept

var useragent = require('useragent');

var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';
var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n';
console.log(useragent.parse(request));

Recommendation

Update to version 2.1.13 or later.

(GitHub Advisory)

5

CVSS Score

Basic Information

CVE ID

CVE-2017-16030

GHSA ID

GHSA-pjmx-9xr3-82qr

EPSS Score

0.55097%

CWE

CWE-400

Published

7/24/2018

Updated

9/6/2023

KEV Status

Technology

JavaScript

Technical Details

CVSS Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
useragent	npm	<= 2.1.12	2.1.13

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security patch adds an isSafe check to the parse() function entry point. The vulnerability exists in the original parse implementation that directly processed untrusted input through regex parsers without validation. The proof of concept directly calls parse() with a malicious payload, making this the primary vulnerable function visible in profiling. While internal regex patterns from ua-parser might be involved, the patch only explicitly modifies the parse function's input validation layer.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* `us*r***nt` *r* vuln*r**l* to r**ul*r *xpr*ssion **ni*l o* s*rvi** w**n *n *r*itr*rily lon* `Us*r-***nt` *****r is p*rs**. ## Proo* o* *on**pt ```js v*r us*r***nt = r*quir*('us*r***nt'); v*r ***Us*r***nt = 'MSI* *.*'+*rr*y(***

Reasoning

T** s**urity p*t** ***s *n isS*** ****k to t** `p*rs*()` *un*tion *ntry point. T** vuln*r**ility *xists in t** ori*in*l `p*rs*` impl*m*nt*tion t**t *ir**tly pro**ss** untrust** input t*rou** r***x p*rs*rs wit*out v*li**tion. T** proo* o* *on**pt *ir*

5

Basic Information

Concerned about an active attack path?

CVE-2017-16030: ReDoS via long UserAgent header in useragent

Proof of Concept

Recommendation

5

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI