# ReDoS( Ruby, Time)

Ruby Time parser ReDoS via invalid strings with specific characters; reachable through Rack::ConditionalGet header parsing in Rails, causing CPU exhaustion.

- Payout: $4,000
- Severity: high
- Program: Internet Bug Bounty
- Found by: ooooooo_q
- Disclosed: 2023-04-26
- CVE: CVE-2023-28756
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1929567
- Library page: https://bugbountylibrary.com/r/h1%3A1929567
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos

**Target:** Time library / Time gem rfc2822 parser reached via Rack::ConditionalGet header
**Root cause:** The Time parser mishandles invalid strings that have specific characters, causing superlinear execution time when parsing to Time objects.
**Steps:**
1. Send a request to a Rails app (uses ::Rack::ConditionalGet by default) with a crafted conditional header value containing the specific invalid characters.
2. Rack::ConditionalGet passes the header value to `Time.rfc2822`, which parses it with catastrophic backtracking.
3. Repeat/scale requests to consume CPU (ReDoS).
**Exploitation:** Attacker sends HTTP requests with crafted header values to a Rails endpoint; Rack::ConditionalGet parses them via Time.rfc2822, triggering ReDoS and increased execution time.
**Insight:** Time-parsing of client-controlled HTTP headers (e.g. conditional-get date headers) is a ReDoS surface; check any library call that feeds request headers into regex-heavy parsers like Time.rfc2822.