PT-2021-23099 · Zulip · Zulip

Erik Krogh Kristensen + 3 · Published 2021-10-07 · Updated 2023-07-17 · CVE-2021-41115

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zulip versions prior to 4.7

Description Zulip is an open source team chat server that allows organization administrators to configure linkifiers, which automatically create links from messages sent by users, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks by configuring a quadratic-time regular expression in a linkifier and sending messages that exploited it. The regular expression attempted to parse user-provided regexes to verify they were safe from ReDoS, but this was insufficient and itself subject to ReDoS if the organization administrator entered a sufficiently complex invalid regex.

Recommendations For versions prior to 4.7, upgrade to the just-released Zulip 4.7 or switch to the main branch to resolve the issue. As a temporary workaround, consider restricting the ability of organization administrators to configure linkifiers until the upgrade is applied.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CVE-2021-41115

GHSA-4H36-MQFQ-42JG

Affected Products

Zulip

References · 6

• 🔥 https://securitylab.github.com/advisories/GHSL-2021-118-zulip-zulip · Exploit
• https://github.com/zulip/zulip/commit/e2d303c1bb5f538d17dc3d9134bc8858bdece781 · Patch
• https://github.com/zulip/zulip/security/advisories/GHSA-4h36-mqfq-42jg · Patch
• https://osv.dev/vulnerability/CVE-2021-41115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41115 · Security Note
• https://t.me/cvenotify/22124 · Telegram Post