[Security] Backend: ReDoS vulnerability in regex pattern validation

[kami922]

Summary

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the _check_username_list_regex() function in buffalogs/impossible_travel/modules/alert_filter.py.

The function compiles user-provided regex patterns without validation, allowing malicious patterns to cause CPU exhaustion and application unavailability.

Vulnerability Details

Severity

High - Can lead to Denial of Service

Affected Component

• File: buffalogs/impossible_travel/modules/alert_filter.py
• Function: _check_username_list_regex() (lines 106-117)
• Attack Vector: Config.ignored_users, Config.enabled_users, Config.vip_users fields

Current Vulnerable Code

def _check_username_list_regex(word: str, values_list: list) -> bool:
    for item in values_list:
        if word == item:
            return True
        try:
            regexp = re.compile(item)  # ⚠️ NO VALIDATION
            if regexp.search(word):
                return True
        except re.error:
            continue
    return False
Proof of Concept
An attacker with admin access could add a malicious regex pattern:

# Malicious pattern
Config.ignored_users = [r"(a+)+"]

# Trigger with crafted input
username = "a" * 50 + "X"

# Result: CPU hangs for minutes/hours due to catastrophic backtracking
Dangerous patterns that can cause ReDoS:
(a+)+ - Nested quantifiers
(a*)* - Nested star operators
(a|ab)* - Overlapping alternation
(\w+)+b - Exponential backtracking

[Lorygold]

Hi, it's quite unlikely that a similar situation will occur. Why do you think this additional check is important?

[kami922]

@Lorygold Hello you are right the probability of such an event is very less likely to occur but its just that this is kinda best practice and recommended by OWSAP https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
PS no system is all secure.

[Lorygold]

I know well, great!

Given the current context, I occasionally need to ask a few clarifying questions to understand which parts were assisted by AI and which were the result of your own work.