Context

tarteaucitron.js is a widely used JavaScript library designed to manage user consent for third-party services. One of its integrations supports embedding content from Issuu, using the issuu_id parameter to construct embed URLs. This parameter was previously validated using permissive regular expressions, exposing the application to a potential ReDoS attack.

Vulnerability Details

The vulnerability originated from the following code:

Codeif (issuu_id.match(/\d+\/\d+/)) {
    issuu_embed = '#' + issuu_id;
} else if (issuu_id.match(/d=(.*)&u=(.*)/)) {
    issuu_embed = '?' + issuu_id;
}

The issues with this implementation are:

• Regular expressions were not anchored, allowing partial matches.
• The use of greedy patterns (.*) on attacker-controlled input.
• Potential for catastrophic backtracking when crafted payloads are supplied. These factors allow an attacker to send specially crafted input that causes the JavaScript regex engine to consume excessive CPU resources.

Proof of Concept (PoC)

An attacker could supply a maliciously crafted issuu_id value containing long repetitive patterns designed to trigger backtracking, for example:

Coded=aaaaaaaaaaaaaaaaaaaaaaaaaaaaa...&u=bbbbbbbbbbbbbbbbbbbbbbbbbbbb...

When processed by the greedy regular expression /d=(.)&u=(.)/, this input can significantly degrade performance, especially when repeatedly evaluated, potentially resulting in a denial of service.

Risk and Impact

• Availability Impact: High CPU exhaustion may lead to temporary service unavailability.
• Confidentiality Impact: None identified.
• Integrity Impact: None identified.

The vulnerability could be exploited remotely by any actor capable of influencing the issuu_id parameter, making it a realistic threat in exposed environments.

Fix

The issue was resolved by simplifying the logic and enforcing strict input validation, as shown in the following patch:

Codeif (issuu_id.match(/^\d+\/\d+$/)) {
    issuu_embed = '#' + issuu_id;
} else {
    issuu_embed = '?' + issuu_id;
}

This fix:

• Anchors the regular expression.
• Removes ambiguous and greedy patterns.
• Eliminates the possibility of catastrophic backtracking.

Additionally, all code related to the legacy Alexa Rank service was removed. This service has been discontinued for several years, and the Alexa domain is now exclusively associated with Amazon’s voice assistant. (commit f0bbdac2fdf3cd24a325fc0928c0d34abf1b7b52)

Acknowledgements

• Yassine Damiri
• Amauri Champeaux

Disclaimer

This document is provided for informational and security awareness purposes only. The information is shared responsibly to help improve software security and should not be used for malicious activities.

Author

Yassine Damiri