CVE-2023-33289
📋 TL;DR
The urlnorm crate through version 0.1.4 for Rust is vulnerable to Regular Expression Denial of Service (ReDos) via specially crafted URLs. This allows attackers to cause excessive CPU consumption and service degradation. Any Rust application using this crate for URL normalization is affected.
💻 Affected Systems
- urlnorm crate
📦 What is this software?
Urlnorm by Urlnorm Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, leading to denial of service for all users and potential cascading failures in dependent systems.
Likely Case
Degraded performance and intermittent service disruptions when malicious URLs are processed, affecting availability but not data integrity.
If Mitigated
Minimal impact with proper input validation, rate limiting, and monitoring in place to detect and block malicious patterns.
🎯 Exploit Status
Proof-of-concept available in references. Exploitation requires sending crafted URLs to systems using the vulnerable crate.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.5 or later
Vendor Advisory: https://github.com/progscrape/urlnorm
Restart Required: Yes
Instructions:
1. Update Cargo.toml to specify urlnorm version '>=0.1.5'. 2. Run 'cargo update' to fetch the patched version. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject malformed URLs before they reach the urlnorm crate.
Rate Limiting
allApply rate limiting to URL processing endpoints to mitigate denial of service attempts.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block patterns known to trigger ReDos in the urlnorm crate.
- Monitor CPU usage and implement automatic throttling or blocking when abnormal patterns are detected.
🔍 How to Verify
Check if Vulnerable:
Check Cargo.toml or Cargo.lock for urlnorm dependency version 0.1.0 to 0.1.4.Check Version:
grep -E 'urlnorm\s*=' Cargo.toml || grep -A1 -B1 'urlnorm' Cargo.lockVerify Fix Applied:
Verify that urlnorm version in Cargo.lock is 0.1.5 or later after running 'cargo update'.📡 Detection & Monitoring
Log Indicators:
- Unusually high CPU usage spikes correlated with URL processing requests
- Increased request processing times for URL-related endpoints
Network Indicators:
- High volume of requests with complex or malformed URL patterns to endpoints using urlnorm
SIEM Query:
source='application_logs' AND (message LIKE '%urlnorm%' OR message LIKE '%URL%processing%') AND cpu_usage > 90🔗 References
- https://gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611
- https://github.com/progscrape/urlnorm
- https://lib.rs/crates/urlnorm
- https://news.ycombinator.com/item?id=40435263
- https://gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611
- https://github.com/progscrape/urlnorm
- https://lib.rs/crates/urlnorm
