Regular Expression Injection in Trudesk

Executive Summary

CVE-2026-114401 is a regular expression injection vulnerability in Trudesk version 1.2.11. It allows unauthenticated attackers to submit regex patterns to the login API endpoint (/api/v1/login). By sending inputs like (admin|root) or a.*, attackers can distinguish between 'Invalid User' and 'Invalid Password' responses to enumerate valid usernames.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor login attempts to the /api/v1/login endpoint for regex patterns like (admin|root) or a.* in POST requests. Check for responses distinguishing 'Invalid User' vs 'Invalid Password' which indicate username enumeration. Use tools like curl to test: curl -X POST -d 'username=(admin|root)&password=test' http://target/api/v1/login

Inspect server logs for repeated failed login attempts with regex syntax. Enable verbose logging in Trudesk if possible to capture detailed request data. Network monitoring tools can detect unusual patterns in API traffic targeting the login endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to discover valid usernames without authentication. This can lead to targeted phishing attacks, brute-force attempts, or further exploitation of other vulnerabilities in the system. Attackers may use this information to gain unauthorized access or escalate privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to enumerate usernames by exploiting regex injection in the login API. While not directly causing data breaches, unauthorized account enumeration violates principles of least privilege and access control required by GDPR and HIPAA. It could enable attackers to identify valid accounts for further exploitation, potentially leading to unauthorized access to sensitive data if combined with other vulnerabilities.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Trudesk to a patched version beyond 1.2.11. If upgrading is not possible, restrict access to the /api/v1/login endpoint via firewall rules or reverse proxy. Implement rate limiting on login attempts to prevent brute force attacks.

Disable debug endpoints and review MongoDB queries for NoSQL injection vulnerabilities. Audit all API endpoints for authorization flaws and enforce strict input validation on all user-supplied data in authentication flows.

Useful 0 Not Useful 0