CVE-2013-7345 in Mac OS X
Summary
by MITRE
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/08/2026
The vulnerability identified as CVE-2013-7345 represents a classic example of a regular expression denial of service (ReDoS) flaw that exists within the file command's magic database implementation. This issue specifically affects the awk script detector component in the file command's magic directory, where a poorly constructed regular expression pattern is used to identify command-based file types. The vulnerability manifests when the system processes ASCII files that contain excessive newline characters, causing the regular expression engine to enter into computationally expensive backtracking operations that consume excessive CPU resources. The flaw is particularly dangerous because it operates in a context-dependent manner, meaning that attackers can craft specific file content that will trigger the vulnerable pattern execution, leading to significant performance degradation or complete system unresponsiveness.
The technical root cause of this vulnerability lies in the BEGIN regular expression pattern that employs multiple wildcards with unlimited repetitions, creating a scenario where the regular expression engine must explore an exponential number of potential matches. This pattern matching behavior is characteristic of ReDoS vulnerabilities, which are categorized under CWE-400 in the Common Weakness Enumeration system. The specific implementation uses a regular expression that allows unlimited repetition of wildcard characters, enabling attackers to craft input that forces the regex engine to perform massive amounts of backtracking operations. When processing files with many newline characters, the system's magic database attempts to match against this vulnerable pattern, causing the CPU to be consumed at an exponential rate proportional to the input size, effectively creating a denial of service condition.
The operational impact of CVE-2013-7345 extends beyond simple resource exhaustion, as it can be leveraged in various attack scenarios that target systems relying on the file command for content detection and classification. Attackers can exploit this vulnerability by creating specially crafted ASCII files that contain numerous newline characters, causing the file command to hang or consume excessive computational resources when processing these files. This vulnerability is particularly concerning in environments where the file command is used as part of automated processing pipelines, content filtering systems, or security scanning tools, as it can be used to disrupt normal operations or create resource exhaustion conditions that affect system availability. The attack surface is broad since many systems use the file command for file type detection, making this vulnerability potentially exploitable in numerous contexts where file content analysis is performed.
The mitigation strategies for this vulnerability involve both immediate patching and long-term architectural improvements to prevent similar issues. The primary fix requires updating the file command to version 5.15 or later, where the vulnerable regular expression has been corrected to eliminate the unlimited repetition patterns that cause excessive backtracking. Additionally, system administrators should implement input validation and sanitization measures to limit the size and complexity of files processed by the file command, particularly in environments where untrusted input is processed. The vulnerability demonstrates the importance of proper regular expression design and the need to avoid patterns that can lead to exponential execution times, aligning with ATT&CK technique T1496 which covers resource exhaustion attacks. Organizations should also consider implementing rate limiting and monitoring for file processing activities to detect and respond to potential exploitation attempts, as the vulnerability can be used in automated attack scenarios where multiple malicious files are processed in sequence to maximize the impact on system resources.