CVE-2024-25354

Executive Summary

CVE-2024-25354 is a Regular Expression Denial of Service (ReDoS) vulnerability in the domain-suffix npm package version 1.0.8. The flaw resides in the parse function, which uses a catastrophic backtracking regular expression that can be exploited by a crafted input string to cause the Node.js application to hang or crash, effectively yielding a denial-of-service condition. Applications that directly or transitively depend on domain-suffix and pass untrusted user-controlled input (such as hostnames or domain strings) to the vulnerable parser are at risk. The CVSS score is unassigned (N/A), but the vulnerability class allows a remote, unauthenticated attacker to exhaust CPU resources with a minimal payload.

Technical Analysis

The vulnerability is a classic ReDoS (Regular Expression Denial of Service) flaw. The domain-suffix package (version 1.0.8) provides functionality to extract the public suffix from a given domain name. This is commonly used for cookie scoping, content security policies, and subdomain detection. The parse function is responsible for splitting and analyzing the input domain string, and it relies on a regular expression to match the TLD (top-level domain) suffix structure.

The vulnerable regex introduces a state of "catastrophic backtracking". This occurs when a regex alternation or grouping constructs contain nested quantifiers (e.g., (a+)+) and the input does not match the expected pattern, causing the regex engine to explore an exponential number of backtracking states. For a maliciously-crafted input string—such as a long sequence of repeating characters with a trailing delimiter that fails to satisfy the pattern—the regex engine will attempt every possible combination of group splits before rejecting the input. The time complexity grows exponentially with the length of the input string.

Attack surface:

• The vulnerable function is parse; it accepts a single string argument (domain name).
• The input is likely passed by applications that process user-supplied hostnames, URLs, or email domains (e.g., a login form that validates an email, a web service that resolves client-provided domains, or an analytics service that parses referrer URLs).
• The attack is entirely remote and requires no authentication; a single HTTP request with a malicious string is sufficient to freeze the event loop.

Code-level mechanism (conceptual): The regex alternation likely contains overlapping alternatives applied to the entire string, such as (?:[a-z]+\.)+[a-z]{2,}. With a crafted input that is nearly a match but has a structural failure at a later position, the engine must split the string across all possible suffix boundaries, leading to exponentially many split attempts on a long enough input.

Exploitation Scenarios

Attack Chain

1. Reconnaissance / Target Identification

   • The attacker identifies the target application's technology stack through HTTP response headers (X-Powered-By: Express), JavaScript bundle analysis, or package-lock.json exposure via misconfigured dev endpoints (e.g., /package.json).
   • The attacker confirms the use of domain-suffix by searching public GitHub code searches or npm dependency graphs for popular open-source projects that depend on this package.
   • The attacker discovers an application endpoint that accepts a domain or email parameter in a POST/GET request (e.g., ?domain=example.com or a registration form's email field).

2. Trigger / Weaponization

   • The payload is URL-encoded and submitted to the vulnerable endpoint. Because Node.js is single-threaded, the synchronous regex execution blocks the event loop during processing.

3. Payload Execution

   • The application calls parse(user_input) with the malicious string.
   • The regex engine enters catastrophic backtracking, consuming 100% CPU on a single core and halting all other request processing for seconds to minutes (scaling with input length).
   • With a slightly longer payload (e.g., 100–200 characters), the app can be crashed entirely (process V8 heap exhaustion or watchdog timeout).

4. Post-Exploitation Impact

   • The application becomes unresponsive to ALL legitimate users (complete denial of service).
   • If the application runs behind a load balancer with health checks, repeated requests will mark the node as unhealthy, triggering instance restarts—but the attacker can repeat the request to continuously knock out instances.
   • In serverless environments (AWS Lambda, Cloud Functions), the attacker can cause excessive runtime and billing spikes, financially damaging the victim.

Impact Assessment

Business Impact: High. A single attacker can force a complete service outage with a small HTTP request. Availability is fully compromised. There is no confidentiality or integrity impact directly, but the service disruption can lead to revenue loss (e-commerce), SLA breaches, or reputational damage.

Affected Systems: All Node.js applications using domain-suffix version 1.0.8 (and possibly earlier versions exhibiting the same regex). Due to npm's deep dependency tree, this package may be a transitive dependency, meaning developers may be unaware they are exposed. The vulnerability is triggered only if untrusted input flows into the parse function.

Blast Radius: The proof-of-concept is trivial; the attack requires no specialized tooling beyond curl. Because no CVSS score is assigned, the risk is often underprioritized; however, the ReDoS class ranks in the OWASP Top 10 (A05:2021 — Security Misconfiguration / A04:2021 — Insecure Design) and can be weaponized in DDoS amplification campaigns targeting multiple endpoints simultaneously.

Detection Guidance

Sigma Rule

title: ReDoS Attempt Against domain-suffix parse Function
id: 8f4f1e9a-5c3e-4a2b-9b1d-2f3a4b5c6d7e
status: experimental
description: Detects HTTP requests containing extremely long repeating-character domain strings which indicate likely ReDoS exploitation of CVE-2024-25354.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25354
tags:
    - attack.t1499
    - attack.t1499.001
author: Valtersit Threat Intel
date: 2024/01/15
logsource:
    category: webserver
    product: generic
detection:
    selection:
        c-uri|contains|all:
            - 'domain='
            - '.'
        c-uri|re: 'domain=[a-z]\.{20,}'   # >20 consecutive same char + dot
    condition: selection
level: high
falsepositives:
    - Legitimate pen-testing
    - DNS queries with unusual but valid punycode

YARA Rule

rule CVE_2024_25354_ReDoS_Domain_Suffix {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects payload strings crafted to exploit ReDoS in domain-suffix parse function"
        date = "2024-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-25354"
        severity = "high"
    strings:
        // >30 repeats of 'a' followed by a dot and an invalid char
        $re_long_repeat = /[a-z]{30,}\.[^a-z]/
        $re_amp_pattern = /(?:a+)+\.$/ nocase
        $re_digit_repeat = /[0-9]{30,}\./
    condition:
        uint16(0) == 0x0A0D or filesize < 10KB and 1 of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-25354 ReDoS Attempt - domain-suffix catastrophic backtracking"; flow:to_server,established; content:"domain="; http_uri; pcre:"/domain=[a-z]\.{30,}/i"; classtype:attempted-dos; reference:cve,2024-25354; sid:2024001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where process.name : "node*" and event.action == "http_request" and request.uri.text : "domain=*" ]
  [ process where process.name : "node*" and process.cpu.usage > 90 and event.duration > 10000 ]

Splunk SPL Query

index=web sourcetype=access_combined_w3c
| rex field=uri "domain=(?<domain_param>[^&]+)"
| eval payload_len = len(domain_param)
| regex domain_param="[a-z]\.{30,}"
| where payload_len > 50
| table _time, src_ip, uri, domain_param, payload_len
| stats count by src_ip
| where count > 10

Wazuh OSSEC Rule

<group name="web, attack, dos,">
    <rule id="100201" level="12">
        <decoded>%WEB</decoded>
        <match>domain=</match>
        <regex>domain=[a-z]\.{30,}</regex>
        <description>CVE-2024-25354: ReDoS attack attempt against domain-suffix parse function.</description>
        <group>attack.dos,</group>
        <mitre><id>T1499.001</id></mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate Mitigations (no-code):

   • Deploy a WAF (Web Application Firewall) rule to reject requests where the domain parameter exceeds 50 characters or contains repeated-character runs longer than 20.
   • Implement an application-level input validation layer: whitelist domain characters (A-Z, 0-9, -, .) and cap input length to 255 characters.
   • Set a hard timeout on the HTTP route handler that processes domain parsing (e.g., setTimeout to abort the request after 100ms), preventing event-loop starvation even if the regex runs.

2. Patch / Upgrade Steps:

   • Verify the patched version of domain-suffix (the vulnerability is reported as fixed in a release after 1.0.8; check the npm registry for the latest version).
   • Run the following in the project root:

     npm install domain-suffix@latest --save
     npm audit fix
     

   • If the package is a transitive dependency, run npm audit and npm audit fix --force after reviewing the dependency chain for compatibility.
   • Confirm the fix by inspecting the parse function source for changes in the regex pattern (look for atomic groups (?>...) or possessive quantifiers a*+ which prevent catastrophic backtracking).

3. Long-Term Hardening:

   • Replace the regex-based parsing with a procedural string-splitting implementation (String.prototype.split('.') — O(n) time, no backtracking).
   • Add ReDoS detection to your CI/CD pipeline: use static analysis tools (e.g., eslint-plugin-security, node-re2) that flag unsafe regexes in dependencies.
   • Subscribe to node security advisories (e.g., GitHub Advisory DB) to receive alerts on future ReDoS vulnerabilities in your dependency tree.
   • For critical public-facing services, run Node.js processes with the --predictable-snapshot flag or use worker threads to isolate CPU-intensive parsers from the main event loop.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-25354
2. npm Package Registry (domain-suffix): https://www.npmjs.com/package/domain-suffix
3. GitHub Advisory Database: https://github.com/advisories?query=CVE-2024-25354
4. OWASP ReDoS Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Regular_Expression_Denial_of_Service_(ReDoS)_Cheat_Sheet.html
5. CISA KEV: Not listed (per the provided data). Threat Actor Campaigns / Exploit-in-the-Wild: As of this writing, no public exploit code or in-the-wild campaigns have been reported. The vulnerability is trivial to weaponize, so monitoring public PoC databases (GitHub, Exploit-DB) is advised.