CVE-2024-21503

What it actually does

A specially crafted string, particularly one with a large number of leading tab characters, can cause a regular expression in the `black` code formatter to exhibit catastrophic backtracking. This leads to excessive CPU consumption, effectively causing the process to hang and become unresponsive, resulting in a Regular Expression Denial of Service (ReDoS).

Why it matters to the business

Systems that automatically run the `black` formatter on untrusted code, such as CI/CD pipelines or web services, are susceptible to a denial-of-service attack. An attacker can trigger this vulnerability to disrupt development workflows, block code deployments, and consume significant compute resources, leading to operational delays and potential service outages.

How an attack unfolds

An attacker identifies a target that uses a vulnerable version of the `black` Python formatter on externally supplied code, such as a CI pipeline that checks pull requests. The attacker crafts a Python file containing a string with thousands of leading tab characters. When this file is submitted, the `black` formatter is invoked. The vulnerable regular expression in the `lines_with_leading_tabs_expanded` function enters a state of catastrophic backtracking, causing the process's CPU usage to spike to 100% and stay there. This freezes the formatting step, which in turn halts the CI/CD pipeline, preventing further builds or merges until the job is manually terminated or times out.

How to fix it

Upgrade the `black` package to version 24.3.0 or later. You can update it using pip: `pip install --upgrade black>=24.3.0`. For systems where `black` is installed via a distribution package manager (e.g., AlmaLinux), apply the corresponding vendor-supplied security updates, such as upgrading `389-ds-base` to version `1.4.3.28-6.module_el8.6.0+2734+1efaf02b` or newer. As a temporary mitigation, avoid running `black` on untrusted input or run it within a container with strict CPU and memory resource limits to contain the impact of a potential DoS.

How to confirm the fix worked

Verify that the installed version of `black` is 24.3.0 or newer by running `pip show black` or `black --version`. To test for the vulnerability, create a Python file containing a docstring with several thousand tab characters (e.g., `"""` + `\t`*5000 + `x` + `"""`) and run the installed `black` formatter on it while monitoring system CPU. A vulnerable version will exhibit sustained 100% CPU usage, while a patched version will complete quickly.

Typical attack path

1. Attacker identifies a target system running a vulnerable version of 'black' on untrusted input, like a CI/CD pipeline.
2. Attacker crafts a malicious Python file containing a string with an excessive number of leading tab characters.
3. Attacker submits the malicious file to the target system (e.g., via a pull request).
4. The automated system invokes the vulnerable 'black' process on the file.
5. The 'black' process consumes 100% CPU, causing a denial of service for the automated task and blocking the pipeline.

How to detect it

Look for `black` processes with abnormally high and sustained CPU utilization in system monitoring tools or Application Performance Monitoring (APM) platforms. Investigate CI/CD jobs that are timing out or failing on code formatting steps. Examine the source code associated with the failed job for files containing strings with an unusually large number of consecutive tab characters, which is the trigger for this vulnerability.

• Process name 'black' with sustained CPU usage near 100%
• Input files containing strings with thousands of consecutive tab characters, e.g., matching regex '\t{1000,}'

What your security team should do

• Immediately upgrade the 'black' package to version 24.3.0 or later in all CI/CD pipelines and other automated systems.
• Audit all development and production environments to identify and upgrade any remaining vulnerable instances of 'black'.
• Implement resource limits (CPU and memory) for tools that process untrusted input in automated pipelines as a defense-in-depth measure against future DoS vulnerabilities.