Regular Expression Denial of Service (ReDoS) in check_processes action (CWE-400)

[jaredbischof]

Summary

Static analysis (Snyk SAST) identified a Regular Expression Denial of Service (ReDoS) vulnerability where unsanitized user input from command line arguments is passed directly to re.search without validation.

Affected File

contrib/linux/actions/checks/check_processes.py (line 73)

def byName(self, name):
    self.name = name
    self.process(criteria="name")
    self.show()

The name parameter is set from CLI input and later used in re.search at line 73:

if re.search(self.name, pInfo[1]):
    self.interestingProcs.append(pInfo)

Impact

A user-supplied process name is used directly as a regular expression pattern. A crafted input string with pathological backtracking patterns (e.g., (a+)+$) could cause the regex engine to consume significant CPU time, effectively causing a denial of service.

While this is contrib code, it ships with StackStorm and may be deployed by users without modification.

Recommended Fix

If regex matching is intentional, sanitize the input or set a timeout. If literal string matching is sufficient, use a simple string comparison instead of re.search:

# Option 1: Escape regex special characters for literal matching
if re.search(re.escape(self.name), pInfo[1]):

# Option 2: Use simple string containment check
if self.name in pInfo[1]:

References

• CWE-400: Uncontrolled Resource Consumption
• Detected by: Snyk Code (SAST)