CVE-2024-8998

Executive Summary

CVE-2024-8998 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting lunary-ai/lunary, a JavaScript-based application. The vulnerability exists in the server-side code at commit f07a845 and allows an unauthenticated attacker to cause a denial of service by sending a specially crafted payload that triggers catastrophic backtracking in the regex engine. The vulnerable regex / {.*?}/ is used to match user-controlled strings, and due to the default JavaScript regex engine's behavior, certain inputs can cause the server to hang for an arbitrary amount of time. The CVSS score is 7.5 (High), and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. The vulnerability is fixed in version 1.4.26.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary package, which is distributed via npm. Users should ensure they are using version 1.4.26 or later. The package is not directly affected by any known supply chain attacks, but the ReDoS vulnerability could be exploited by malicious actors to disrupt services.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The threat level is High due to the low attack complexity and the potential for significant availability impact. An unauthenticated attacker can cause the server to hang indefinitely, leading to a denial of service.

Deep Dive & Mechanics

The vulnerability is a classic ReDoS (Regular Expression Denial of Service) caused by the regex pattern / {.*?}/. This pattern uses a lazy quantifier (*?) but is vulnerable to catastrophic backtracking when combined with certain inputs. Specifically, the regex is used to match user-controlled strings, and an attacker can craft a payload that causes the regex engine to take polynomial time to evaluate.

The vulnerable regex attempts to match a space character followed by any characters (lazy) and then a closing brace. However, due to the way the regex engine handles backtracking, a payload like { followed by many spaces and then a newline can cause the engine to try many combinations, leading to a hang.

The fix in version 1.4.26 replaces the vulnerable regex with a more efficient pattern that avoids catastrophic backtracking, likely by using a possessive quantifier or a more specific character class.

Vulnerable vs. Patched Code

Vulnerable Code (commit f07a845):

// Example vulnerable usage
const regex = /{.*?}/;
const userInput = req.body.input;
if (regex.test(userInput)) {
    // process input
}

Patched Code (version 1.4.26):

// Example patched usage
const regex = /{[^}]*}/; // More efficient pattern
const userInput = req.body.input;
if (regex.test(userInput)) {
    // process input
}

The patched regex uses a negated character class [^}]* which matches any character except }, eliminating the need for backtracking and preventing ReDoS.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can send a crafted payload to the server that triggers catastrophic backtracking. The following Python script demonstrates the exploit:

import requests

target_url = "http://target-server.com/endpoint"
payload = "{" + " " * 10000 + "\n"  # Crafted payload to cause ReDoS

response = requests.post(target_url, data={"input": payload})
print(f"Status: {response.status_code}")
# The server may hang or timeout

The payload consists of a single { followed by many spaces and a newline. This causes the regex engine to attempt many combinations, leading to a denial of service.

Blue Team

To detect exploitation attempts, monitor for requests with unusually long payloads containing many spaces or repeated characters. Implement rate limiting and input validation to mitigate the risk. Use the following detection rules:

• Network: Look for HTTP requests with large payloads (e.g., > 1KB) that contain patterns like { followed by many spaces.
• Application: Monitor server CPU usage and response times for anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests with payloads containing { followed by many spaces (e.g., { + 1000+ spaces).
  • Unusually high server response times or timeouts.
• File IOCs:
  • Log entries showing repeated regex matches or timeouts.
• Behavioral IOCs:
  • Server CPU spikes without corresponding legitimate traffic.

Detection Engineering

YARA Rule

rule CVE_2024_8998_ReDoS {
    meta:
        description = "Detects ReDoS payloads targeting CVE-2024-8998"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8998"
    strings:
        $payload = /{[\s]{100,}}/  // Matches { followed by 100+ whitespace chars
    condition:
        $payload
}

Sigma Rule

title: CVE-2024-8998 ReDoS Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with ReDoS payloads targeting lunary-ai/lunary
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '{'
        sc-bytes|gte: 1000
    condition: selection
falsepositives:
    - Legitimate large payloads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8998 ReDoS Exploitation Attempt"; flow:to_server; content:"{"; http_client_body; pcre:"/{\s{100,}}/R"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Immediately update lunary-ai/lunary to version 1.4.26 or later.
2. Input Validation: Implement strict input validation to limit the length and content of user-controlled strings.
3. Rate Limiting: Apply rate limiting to endpoints that accept user input to reduce the impact of DoS attacks.
4. Web Application Firewall (WAF): Deploy WAF rules to block requests with suspicious patterns (e.g., long strings of spaces).
5. Monitoring: Monitor server performance and logs for signs of ReDoS attacks.

Valters IT
Securing Digital Frontiers