-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in a flawed attempt to fix a Regular Expression Denial of Service (ReDoS) vulnerability in fastapi-guard version 3.0.1. The developers introduced bounded quantifiers to the regular expressions used for detecting malicious patterns, such as XSS and SQL Injection. This was done in the SusPatternsManager class in guard/handlers/suspatterns_handler.py as seen in commit d9d50e8130b7b434cdc1b001b8cfd03a06729f7f.
The core of the vulnerability is that these bounded regexes can be bypassed. The function responsible for using these flawed regexes is guard.utils.detect_penetration_attempt. This function is called by the guard.middleware.SecurityMiddleware.dispatch method for each incoming request when penetration detection is enabled. An attacker can send a malicious payload where the length of certain parts of the string exceeds the bounds specified in the regex. This causes the regex match to fail, and the payload is allowed to pass through, leading to a successful bypass of the security filter.
The fixing commit, 0829292c322d33dc14ab00c5451c5c138148035a, addresses this by reverting the regexes to their previous unbounded state and introducing a more robust ReDoS mitigation strategy. It adds a timeout mechanism to the regex matching process within detect_penetration_attempt. This ensures that even with complex patterns, the application remains responsive and is not vulnerable to ReDoS, while also correctly identifying malicious payloads regardless of their length. Therefore, any runtime profile of an exploitation attempt would prominently feature the detect_penetration_attempt function, which is the central point of the flawed security check.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fastapi-guard | pip | = 3.0.1 | 3.0.2 |