Regular Expression Denial of Service in String::Util Perl Module

Executive Summary

This vulnerability affects String::Util versions before 1.36 for Perl, where the trim and rtrim functions use a regular expression that can cause a denial of service.

Specifically, the functions use the regex s/\s*$//u to strip trailing whitespace. Because \s* matches greedily and the $ anchor fails when a non-whitespace character follows, the regex engine performs excessive backtracking on long runs of whitespace, leading to quadratic time complexity.

An attacker can exploit this by passing untrusted input containing a long sequence of whitespace to these functions, causing CPU exhaustion.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial of service condition by exhausting CPU resources when processing specially crafted input with long runs of whitespace.

If an application uses the affected trim or rtrim functions on untrusted input, an attacker could cause the application to become unresponsive or slow down significantly.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade String::Util to version 1.36 or later where the issue is fixed.

Avoid passing untrusted input containing long runs of whitespace to the trim or rtrim functions in affected versions.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a regular expression denial of service (ReDoS) in the trim and rtrim functions of String::Util versions before 1.36 for Perl. Detection involves identifying if your system is running a vulnerable version of the String::Util Perl module.

To detect the vulnerability on your system, you can check the installed version of the String::Util Perl module. If it is before version 1.36, your system is vulnerable.

You can use the following Perl command to check the installed version of String::Util:

• perl -MString::Util -e 'print $String::Util::VERSION, "\n";'

If the output version is less than 1.36, the module is vulnerable.

Additionally, to detect exploitation attempts on your network or system, monitor for processes or scripts that call trim or rtrim functions with unusually long whitespace strings, which may cause high CPU usage or exhaustion.

There are no specific network commands or signatures provided in the resources to detect exploitation attempts directly.

Useful 0 Not Useful 0