ReDoS Vulnerability in Markdown2 via Malicious Markdown

Executive Summary

This is a Regular Expression Denial of Service (ReDoS) vulnerability in the python-markdown2 library affecting versions 2.5.5 and earlier. It occurs in the metadata parsing function when enabled. A crafted metadata value with excessive spaces after a hyphen triggers super-linear regex backtracking, causing excessive CPU usage and application hangs.

Useful 0 Not Useful 0

Detection Guidance

To detect this ReDoS vulnerability in markdown2, inspect Python applications using markdown2 v2.5.5 or earlier with metadata extra enabled. Check for unusually high CPU usage when processing large Markdown files with crafted metadata values containing many spaces after a hyphen. Monitor logs for slow responses or hangs during metadata parsing.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to make the application unresponsive for seconds to minutes by submitting a specially crafted document. This could disrupt services, degrade performance, or crash the application if metadata extra is enabled.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update markdown2 to a patched version if available. If not, disable the metadata extra feature in markdown2 configurations. Alternatively, implement input validation to limit metadata value length and avoid regex patterns with unbounded quantifiers. Review regex patterns in _key_val_list_pat for overlapping quantifiers.

Useful 0 Not Useful 0