Web-based software services use server-side input sanitization to guard against harmful input. Web services sometimes publish their sanitization logic to make their client interface more usable, e.g., allowing clients to debug invalid requests locally. However, this usability practice poses a security risk. Many services share the regexes they use to sanitize input strings — and regex-based denial of service (ReDoS) is an emerging threat. Recent service outages caused by ReDoS spurred interest in this topic. We know little about the degree to which live web services are vulnerable to ReDoS.

In this paper, we conduct the first black-box study measuring the extent of ReDoS vulnerabilities in live web services. We apply the Consistent Sanitization Hypothesis: that client-side sanitization logic, including regexes, is consistent with the sanitization logic on the server-side.We identify a service’s regex-based client-side input sanitization in its HTML forms or its API, find vulnerable regexes among these regexes, craft ReDoS probes, and pinpoint ReDoS vulnerabilities. We analyzed the HTML forms of 1,000 services and the APIs of 475 services. Of these, 355 services publish regexes; 17 services publish unsafe regexes; and 6 services are vulnerable to ReDoS (6 domains; 15 subdomains). One service was patched as a result of our disclosure. Since these vulnerabilities were from API specifications, not HTML forms, we proposed a ReDoS defense for a popular API validation library. To summarize: through their client-visible sanitization logic, some web services advertise their ReDoS vulnerabilities in plain sight. Our results motivate short-term patches and long-term fundamental solutions.