February 2020 Summaries

Bento version 0.9 introduces important security features, including a check for a high-severity Python vulnerability CVE-2020-8492, which involves regex denial of service (ReDoS) and can be run on codebases using the Dlint tool. This vulnerability previously caused a significant outage for Cloudflare in 2019. The update also adds checks for Jinja, Flask's HTML template engine, focusing on preventing cross-site scripting (XSS) by ensuring proper text escaping and the inclusion of noreferrer and noopener attributes. Additionally, Bento is developing a GitHub Action, inviting early users to provide feedback and support for its integration. Users are encouraged to upgrade to the latest version via pip and to reach out for support or discussion through email or Slack.

ReDoS (Regular Expression Denial-of-Service) vulnerabilities arise when inefficient regular expressions, often involving nested quantifiers or mutually inclusive alternation, are exploited by specially crafted strings, causing excessive backtracking and potentially leading to application security issues. A notable instance of such a vulnerability caused a global outage for Cloudflare in July 2019 due to a single poorly written WAF rule. To address these vulnerabilities, Bento includes a check in its version 0.9 to identify inefficient regular expressions in Python projects, leveraging heuristics and program analysis to detect such patterns. Initial tests of the Bento check revealed vulnerabilities in various widely-used Python projects, including the Python urllib module, leading to Python bpo-39503 and CVE-2020-8492. Users of Python projects can utilize Bento to identify and mitigate ReDoS vulnerabilities, ensuring better security and availability of their applications.

Regular expression denial-of-service (ReDoS) occurs when a specially crafted input string causes inefficient regular expressions to take an excessively long time to process, leading to potential denial-of-service attacks. Key examples include nested quantifiers and mutually inclusive alternations, which can result in catastrophic backtracking, impacting application security and availability. To address these vulnerabilities, Python static analysis tools, such as Dlint, have been developed to detect inefficient regex patterns that could lead to ReDoS. Dlint has been integrated into r2c's distributed analysis platform, allowing for large-scale detection of such bugs across numerous open-source Python projects. The platform's findings include both true positives, which can improve project resilience, and false positives, which help refine detection algorithms. A notable discovery was a ReDoS vulnerability in the urllib.request module related to HTTP authentication, leading to the identification of Python bpo-39503 and CVE-2020-8492. These tools and methodologies facilitate the identification and mitigation of ReDoS vulnerabilities, contributing to more secure and reliable software.