Regular Expression ReDoS in Wildcard Path Parameters (v

Impact Analysis

This vulnerability can lead to a denial of service (DoS) condition by exploiting the backtracking behavior of the generated regular expressions.

An attacker can craft input that causes excessive processing time, potentially making the affected system unresponsive or significantly degraded in performance.

Useful 0 Not Useful 0

Executive Summary

This vulnerability occurs when multiple wildcards are used in combination with at least one parameter in a path, which can generate a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS).

The issue arises because the backtracking in the regular expression can be exploited, especially when the second wildcard is located somewhere other than at the end of the path.

Unsafe examples of vulnerable paths include patterns like /*foo-*bar-:baz, /*a-:b-*c-:d, and /x/*a-:b/*c/y, whereas safe examples include /*foo-:bar and /*foo-:bar-*baz.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the regular expression output generated from your wildcard parameters to see if it is vulnerable to ReDoS.

A suggested method is to use an online tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path with multiple wildcard parameters is vulnerable.

No specific commands are provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade to version 8.4.0 where the issue is patched.

As a workaround, if you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.

Useful 0 Not Useful 0