CVE-2007-2163 in Safari
Summary
by MITRE
Apple Safari allows remote attackers to cause a denial of service (browser crash) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2017
The vulnerability identified as CVE-2007-2163 represents a classic example of a regular expression denial of service attack targeting Apple Safari web browser. This flaw demonstrates how seemingly benign JavaScript functionality can be exploited to disrupt browser operations and potentially compromise user experience. The vulnerability specifically affects the JavaScript engine within Safari, where the processing of certain regular expression patterns can lead to excessive resource consumption and eventual browser crash.
The technical mechanism behind this vulnerability involves the exploitation of backtracking behavior in regular expression engines. When the JavaScript pattern `/(.)/` is applied against a long string, the regular expression engine enters into an exponential backtracking state where it attempts to match the pattern in multiple overlapping ways. This occurs because the pattern `(.)` matches any character and the `` quantifier allows for zero or more occurrences, creating a scenario where the engine must explore numerous potential matches for each character in the input string. The flaw is particularly pronounced when processing long strings, as the computational complexity grows exponentially rather than linearly, leading to resource exhaustion.
From an operational impact perspective, this vulnerability enables remote attackers to craft malicious web pages that can crash Safari browsers when users navigate to them. The attack vector is particularly concerning because it requires no user interaction beyond visiting the compromised webpage, making it a passive attack method. Users may experience unexpected browser crashes, loss of unsaved work, and potential disruption to their browsing session. The vulnerability affects all versions of Safari that were vulnerable to this specific regular expression backtracking behavior, representing a fundamental flaw in the JavaScript engine's pattern matching implementation.
The exploitation of this vulnerability aligns with attack patterns documented in the MITRE ATT&CK framework under the technique of "Exploitation for Client Execution" where adversaries leverage browser vulnerabilities to execute malicious code or cause system instability. This particular vulnerability also relates to CWE-400, which describes "Uncontrolled Resource Consumption" and specifically addresses the issue of regular expression denial of service attacks. The vulnerability demonstrates how improper input validation and lack of resource limits in regular expression engines can create security weaknesses that can be systematically exploited.
Mitigation strategies for this vulnerability should include updating to patched versions of Safari where Apple addressed the regular expression engine implementation. System administrators should ensure that users maintain current browser versions and implement security policies that limit exposure to untrusted web content. Additionally, web developers should be aware of this vulnerability and avoid using regular expressions with exponential backtracking patterns in client-side code. Organizations should also consider implementing web application firewalls or content filtering solutions that can detect and block suspicious regular expression patterns. The vulnerability highlights the importance of implementing proper input validation and resource limiting mechanisms in all software components that process user-supplied data.