Skip to content

Commit dd5532c

Browse files
author
Nicholas Starke
committed
Addressing Formatting Issues
There were several formatting and layout issues that are fixed in this commit. Also changing `RHOSTS` to `RHOST`.
1 parent 2d23054 commit dd5532c

File tree

2 files changed

+10
-6
lines changed

2 files changed

+10
-6
lines changed

documentation/modules/auxiliary/dos/http/ua_parser_js_redos.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
11
## Vulnerable Application
2+
23
This auxiliary module exploits a Regular Expression Denial of Service vulnerability
34
in the npm module `ua-parser-js`. Versions before 0.7.16 are vulnerable.
45
Any application that uses a vulnerable version of this module and calls the `getOS`
56
or `getResult` functions will be vulnerable to this module. An example server is provided
67
below.
78

9+
## How to Install
10+
11+
To install a vulnerable version of `ua-parser-js`, run:
812
```
913
1014
```
@@ -21,7 +25,7 @@ Example steps in this format (is also in the PR):
2125
7. Open up a new terminal.
2226
8. Start msfconsole.
2327
9. `use auxiliary/dos/http/ua_parser_js_redos`.
24-
10. `set RHOSTS <IP>`.
28+
10. `set RHOST <IP>`.
2529
11. `run`.
2630
12. In vulnerable installations, Module should have positive output and the test application should accept no further requests.
2731
13. In non-vulnerable installations, module should have negative output and the test application should accept further requests.

modules/auxiliary/dos/http/ua_parser_js_redos.rb

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,25 +9,25 @@ class MetasploitModule < Msf::Auxiliary
99

1010
def initialize
1111
super(
12-
'Name' => 'ua-parser-js npm module ReDoS',
13-
'Description' => %q{
12+
'Name' => 'ua-parser-js npm module ReDoS',
13+
'Description' => %q{
1414
This module exploits a Regular Expression Denial of Service vulnerability
1515
in the npm module "ua-parser-js". Server-side applications that use
1616
"ua-parser-js" for parsing the browser user-agent string will be vulnerable
1717
if they call the "getOS" or "getResult" functions. This vulnerability was
1818
fixed as of version 0.7.16.
1919
},
20-
'References' =>
20+
'References' =>
2121
[
2222
['URL', 'https://github.com/faisalman/ua-parser-js/commit/25e143ee7caba78c6405a57d1d06b19c1e8e2f79'],
2323
['CWE', '400'],
2424
],
25-
'Author' =>
25+
'Author' =>
2626
[
2727
'Ryan Knell, Sonatype Security Research',
2828
'Nick Starke, Sonatype Security Research',
2929
],
30-
'License' => MSF_LICENSE
30+
'License' => MSF_LICENSE
3131
)
3232

3333
register_options([

0 commit comments

Comments
 (0)