CVE-2023-31606
📋 TL;DR
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the sanitize_html function of the redcloth gem v4.0.0. Attackers can cause denial of service by sending specially crafted HTML payloads that trigger catastrophic backtracking in regular expressions. This affects any application using the vulnerable redcloth gem version.
💻 Affected Systems
- redcloth gem
📦 What is this software?
Redcloth by Promptworks
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting all users of the application.
Likely Case
Degraded performance or temporary service disruption for affected endpoints processing malicious input.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending crafted HTML payloads to endpoints using the vulnerable function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.1
Vendor Advisory: https://github.com/jgarber/redcloth/issues/73
Restart Required: Yes
Instructions:
1. Update Gemfile to specify 'gem "redcloth", ">= 4.0.1"' 2. Run 'bundle update redcloth' 3. Restart application server
🔧 Temporary Workarounds
Input validation and sanitization
allImplement additional input validation to reject suspicious HTML patterns before reaching sanitize_html function.
Rate limiting
allImplement rate limiting on endpoints using redcloth to prevent repeated exploitation attempts.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block suspicious HTML patterns
- Disable or restrict endpoints using redcloth sanitize_html function
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock or run 'bundle show redcloth' to see if version 4.0.0 is installed.Check Version:
bundle show redclothVerify Fix Applied:
Verify redcloth version is 4.0.1 or higher using 'bundle show redcloth' or checking Gemfile.lock.📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for HTML input
- High CPU usage spikes
- Requests with complex HTML patterns
Network Indicators:
- Repeated requests with similar HTML payloads
- Traffic patterns suggesting DoS attempts
SIEM Query:
source=application_logs AND (message="*redcloth*" OR message="*sanitize_html*") AND duration>5000ms🔗 References
- https://github.com/e23e/CVE-2023-31606#readme
- https://github.com/jgarber/redcloth
- https://github.com/jgarber/redcloth/issues/73
- https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
- https://security.gentoo.org/glsa/202401-14
- https://github.com/e23e/CVE-2023-31606#readme
- https://github.com/jgarber/redcloth
- https://github.com/jgarber/redcloth/issues/73
- https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
- https://security.gentoo.org/glsa/202401-14
