CVE-2024-36751
📋 TL;DR
This vulnerability in parse-uri v1.0.9 allows attackers to cause a Denial of Service (DoS) by sending specially crafted URLs that trigger inefficient regular expression processing. Anyone using the affected parse-uri library version in their applications is vulnerable to service disruption.
💻 Affected Systems
- parse-uri
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion from ReDoS, potentially affecting all users of the vulnerable application.
Likely Case
Degraded performance or temporary service disruption for users accessing the vulnerable endpoint with malicious URLs.
If Mitigated
Minimal impact with proper input validation, rate limiting, and monitoring in place.
🎯 Exploit Status
Proof of concept available in GitHub issue. Exploitation requires sending a malicious URL to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.10 or later
Vendor Advisory: https://github.com/Kikobeats/parse-uri/issues/14
Restart Required: No
Instructions:
1. Update parse-uri dependency to v1.0.10 or later. 2. Run npm update parse-uri or yarn upgrade parse-uri. 3. Test application functionality.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict URL validation before passing to parse-uri library
Rate limiting
allImplement request rate limiting to prevent DoS attacks
🧯 If You Can't Patch
- Implement WAF rules to block suspicious URL patterns
- Monitor CPU usage and implement automatic throttling on high load
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for parse-uri version 1.0.9Check Version:
npm list parse-uriVerify Fix Applied:
Verify parse-uri version is 1.0.10 or later in package.json📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- Unusually long URL processing times
- Multiple failed requests with similar URL patterns
Network Indicators:
- Multiple requests with unusually long or complex URLs
- Requests causing timeout responses
SIEM Query:
source="application_logs" AND (message="CPU spike" OR message="timeout" OR url_length>1000)