ReDoS in JLine DefaultHistory via Malicious HISTORY_IGNORE Pattern

Executive Summary

This is a Regular Expression Denial of Service (ReDoS) vulnerability in the JLine Java library. It occurs when the HISTORY_IGNORE configuration value is converted into a Java regex without fully escaping special characters. Attackers can craft malicious patterns with nested quantifiers like (a+)+b that cause the regex engine to consume excessive CPU resources through catastrophic backtracking, indefinitely blocking the reader thread.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to applications using JLine versions 3.0.0 to 3.30.14 and below 4.3.1. To detect it, check the version of JLine in your application dependencies. For Java applications, inspect the pom.xml or build.gradle files for org.jline:jline-reader. If using a vulnerable version, the application may hang when processing history commands with malicious HISTORY_IGNORE patterns.

Useful 0 Not Useful 0

Impact Analysis

If you use applications built with vulnerable JLine versions (3.0.0-3.30.14 or <4.3.1) where users can configure HISTORY_IGNORE, an attacker could exploit this to make the application unresponsive by adding specially crafted commands to history. This would cause high CPU usage and potentially crash the application.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade JLine to version 3.30.15 or 4.3.1 or later to apply the SafeRegex timeout mechanism.
• Review and sanitize HISTORY_IGNORE configurations to prevent regex metacharacter injection.
• Monitor application logs for high CPU usage during history operations, which may indicate exploitation attempts.

Useful 0 Not Useful 0