CVE-2021-41817
📋 TL;DR
CVE-2021-41817 is a regular expression denial of service (ReDoS) vulnerability in Ruby's date gem. Attackers can cause denial of service by sending specially crafted long strings to Date.parse methods. This affects Ruby applications using vulnerable versions of the date gem.
💻 Affected Systems
- Ruby date gem
📦 What is this software?
Date by Ruby Lang
Date by Ruby Lang
Date by Ruby Lang
Date by Ruby Lang
Factory by Opensuse
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Ruby by Ruby Lang
Ruby by Ruby Lang
Ruby by Ruby Lang
⚠️ Risk & Real-World Impact
Worst Case
Complete application unavailability due to CPU exhaustion from processing malicious input, leading to service disruption.
Likely Case
Degraded performance or temporary unavailability of affected endpoints that parse dates from user input.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending a specially crafted long string to Date.parse. The HackerOne report demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.1, 3.1.2, 3.0.2, or 2.0.1
Vendor Advisory: https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/
Restart Required: Yes
Instructions:
1. Update the date gem: gem update date
2. Update Gemfile to specify patched version
3. Run bundle update date
4. Restart the Ruby application
🔧 Temporary Workarounds
Input validation and length restriction
allValidate and limit length of input passed to Date.parse methods
# In Ruby code, validate input before parsing:
if date_string && date_string.length < 100
Date.parse(date_string)
else
# Handle invalid input
end
🧯 If You Can't Patch
- Implement strict input validation and length limits on all date parsing inputs
- Deploy rate limiting and WAF rules to block suspicious patterns in date inputs
🔍 How to Verify
Check if Vulnerable:
Check date gem version: gem list date | grep dateCheck Version:
gem list date | grep -E 'date \([0-9]+\.'Verify Fix Applied:
Verify date gem version is 3.2.1, 3.1.2, 3.0.2, or 2.0.1 or higher📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for date parsing operations
- High CPU usage spikes correlated with date parsing requests
Network Indicators:
- Requests with unusually long date parameter values
- Repeated requests with similar long date strings
SIEM Query:
source="application.log" AND ("Date.parse" OR "date parsing") AND duration>5s🔗 References
- https://hackerone.com/reports/1254844
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/
- https://security.gentoo.org/glsa/202401-27
- https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/
- https://hackerone.com/reports/1254844
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/
- https://security.gentoo.org/glsa/202401-27
- https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/
