PT-2021-20214 · Roller · Roller

Ed Ra · Published 2021-08-18 · Updated 2021-08-26 · CVE-2021-33580

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Roller versions prior to 6.0.2

Description The issue arises from user-controlled inputs request.getHeader("Referer"), request.getRequestURL(), and request.getQueryString() being used to build and execute a regex expression. An attacker can send a specially crafted Referer header programmatically, without needing a browser, and potentially cause a ReDoS (Regular expression Denial of Service) through regex catastrophic backtracking on the server side.

Recommendations For versions prior to 6.0.2, update to Roller 6.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable regex functionality until the update can be applied. Avoid using the request.getHeader("Referer"), request.getRequestURL(), and request.getQueryString() inputs in the affected regex expression until the issue is resolved.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-33580

Affected Products

Roller

References · 7

• https://lists.apache.org/thread.html/r9d967d80af941717573e531db2c7353a90bfd0886e9b5d5d79f75506%40%3Cuser.roller.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33580 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33580 · Vendor Advisory
• https://t.me/cvenotify/20130 · Telegram Post
• http://openwall.com/lists/oss-security/2021/08/18/1 · Note
• https://t.me/cvenotify/19582 · Telegram Post
• https://t.me/cibsecurity/27489 · Telegram Post