Open Mercato Regex Rule DoS Vulnerability

Executive Summary

This vulnerability is a Regular Expression Denial of Service (ReDoS) issue in Open Mercato. It occurs because the software does not properly validate regex rules. An attacker with sufficient privileges can create a malicious regex pattern and attach it to a field. When a specific string is provided, it triggers excessive computational load, causing a denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Open Mercato instance is running a version older than 0.6.4. Use commands like 'npm list open_mercato' or 'grep -r "open_mercato" package.json' to verify the installed version. Monitor for unusual CPU spikes or unresponsive services during regex-heavy operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to system downtime or degraded performance if exploited. Attackers could send crafted inputs that cause the regex engine to consume excessive CPU resources, potentially crashing the application or making it unresponsive for legitimate users.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open Mercato to version 0.6.4 or later immediately. If upgrading is not possible, restrict regex rule creation permissions to trusted users only. Review and remove any custom regex rules that use unbounded patterns or wildcards.

Useful 0 Not Useful 0