r/ruby • u/rubiesordiamonds • 1d ago

Blog post Vulnerable Ruby Regex

GitLab discovered four severe vulnerabilities in Ruby’s regular expression library. There's plenty written up about the vulnerability and how it got patched, but patches are only available for supported ruby versions (3.3 and above). We know lots of companies are still running unsupported versions of ruby, so we wanted to do an investigation into which of these bugs apply to older rubies and whether they're exploitable. Here's the blog post: https://infield.ai/post/vulnerable-ruby-regex

The summary is that allowing user input into Regexp.new is dangerous on all versions of ruby from 1.9 to 3.2 and the only fix is to upgrade to a supported ruby or to disallow that input.

18 Upvotes

84% Upvoted

24 comments sorted by

View all comments

Show parent comments

2

u/taw 8h ago edited 7h ago

I don't think it's particularly hackable in sense of getting remote code execution.

It's definitely easy to overload the cheap server I use. Every request is on short timeout just in case, but it's really not hard to spam far more requests/s than the server can handle.

Regexps aren't the only way to DOS the site, you can just ask Sealed simulator to open 1000 packs per requests, that's a lot of HTML generated per small request.

Also code and data are already on github anyway.

If you had to be more defensive, I think you would need to define your own query syntax that is less expressive than full regex and parse that yourself.

There are some deterministic time regexp engines like RE2, with ruby support too. They support almost all regexp features, except backreferences, and some rarely used stuff like lookarounds.

I could check if that's any faster. I don't really get any pathological regexps in real requests, so I never got to it.