PT-2023-29703 · Unknown+1 · Python-Validators+1

Ikkebr · Published 2023-10-18 · Updated 2023-10-30 · CVE-2023-45813

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Torbot versions prior to 4.0.0

Description The issue concerns the torbot.modules.validators.validate link function, which uses the python-validators URL validation regex. This regular expression has exponential complexity, allowing an attacker to cause an application crash using a well-crafted argument. An attacker can exploit the vulnerability in the regular expression using a well-crafted URL argument, causing a Denial of Service on the system.

Recommendations For versions prior to 4.0.0, users are advised to upgrade to version 4.0.0 or later, as the validators file has been removed in this version, resolving the issue. As a temporary workaround, consider disabling the torbot.modules.validators.validate link function until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2023-45813

GHSA-72QW-P7HH-M3FF

Affected Products

Torbot

Python-Validators

References · 12

• 🔥 https://github.com/DedSecInside/TorBot/security/advisories/GHSA-72qw-p7hh-m3ff · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45813.json · Exploit
• https://github.com/DedSecInside/TorBot/commit/ef6e06bc7785355b1701d5524eb4550441086ac4 · Patch
• https://osv.dev/vulnerability/CVE-2023-45813 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45813 · Security Note
• https://osv.dev/vulnerability/GHSA-72qw-p7hh-m3ff · Vendor Advisory
• https://github.com/DedSecInside/TorBot · Note
• https://github.com/DedSecInside/TorBot/blob/d2b89192379ad033ffc7044efff26e16ccc02d5a/torbot/modules/validators.py#L13 · Note
• https://gist.github.com/ikkebr/6041055314f1cfb8e65b2a1acbaae12c · Note
• https://twitter.com/CVEnew/status/1714742812975976754 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714769784233947489 · Twitter Post
• https://t.me/cibsecurity/72537 · Telegram Post