WP-GeSHi-Highlight <= 1.4.3 – Author+ ReDoS | CVE 2024-13896

Description

The plugin processes user-supplied input as a regular expression via the wp_geshi_filter_replace_code() function, which could lead to Regular Expression Denial of Service (ReDoS) issue

Proof of Concept

Steps to reproduce:
1. Install the plugin
2. Generate the payload (for example with str_repeat('<pre lang="php">', 20000) in PHP)
3. As an author, publish a new post containing the payload
4. Monitor CPU usage and load average of server
5. Trigger 20 concurrent requests to the page containing the payload

Each request uses 100 % of a CPU core for a couple of seconds (depending on CPU power). This was reproduced on an Intel i7 2.80GHz CPU.

This increased server load does not happen when the plugin is disabled.