Vulnerability in Dedsecinside Torbot

CVE-2023-45813

Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: ReDoS (Regular Expression Denial of Service)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.008 (55.1th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2023-45813: held from 0.008 to 0.008.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2023-45813?
CVE-2023-45813 is a medium-severity vulnerability in Dedsecinside Torbot, classified under Inefficient Regular Expression Complexity. CVSS score: 4.6/10. Published 2023-10-18.
How severe is CVE-2023-45813?
Medium severity. CVSS v3 base score is 4.6 out of 10.
Is CVE-2023-45813 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.