Internet Bug Bounty · Report #1929567
ReDoS( Ruby, Time)
Summary
CVE-2023-28756: ReDoS vulnerability in Time
We have released the time gem version 0.1.1 and 0.2.2 that has a security fix for a ReDoS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2023-28756.
Details The Time parser mishandles invalid strings that have specific characters. It causes an increase in execution time for parsing strings to Time objects.
A ReDoS issue was discovered in the Time gem 0.1.0 and 0.2.1 and Time library of Ruby 2.7.7.
Recommended action We recommend to update the time gem to version 0.2.2 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:
For Ruby 3.0 users: Update to time 0.1.1 For Ruby 3.1/3.2 users: Update to time 0.2.2 You can use gem update time to update it. If you are using bundler, please add gem "time", ">= 0.2.2" to your Gemfile.
Unfortunately, time gem only works with Ruby 3.0 or later. If you are using Ruby 2.7, please use the latest version of Ruby.
Affected versions Ruby 2.7.7 or lower time gem 0.1.0 time gem 0.2.1
Credits Thanks to ooooooo_q for discovering this issue.
Security Advisory: https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/
How it was found
I reported at https://hackerone.com/reports/1485501
https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/
The Time parser mishandles invalid strings that have specific characters. It causes an increase in execution time for parsing strings to Time objects. A ReDoS issue was discovered in the Time gem 0.1.0 and 0.2.1 and Time library of Ruby 2.7.7.
Impact
ReDoS occurs when Time.rfc2822 accepts user input.
In Rack::ConditionalGet, the header value is parsed by Time.rfc2822, it is possible to attack from the request.
Rails uses ::Rack::ConditionalGet by default, it can be attacked by a request from the client.