CWE-185

W bibliotece Artifex MuJS 1.0.5 odkryto podatność polegającą na braku ograniczenia rozmiaru programu wyrażenia regularnego w funkcji regcompx w pliku regexp.c. Prowadzi to do przepełnienia bufora listy składni, co zostało ocenione jako krytyczne zagrożenie (CVSS 9.8).

Biblioteka PCRE (Perl Compatible Regular Expressions) w wersjach przed 8.38 nieprawidłowo obsługuje określone wzorce wyrażeń regularnych, co może prowadzić do nieskończonej rekurencji. Podatność jest krytyczna, ponieważ może być wywołana zdalnie bez uwierzytelnienia przez przesłanie sprytnie skonstruowanego wyrażenia regularnego.

Biblioteka fast-xml-parser w wersjach od 4.1.3 do przed 5.3.5 zawiera podatność umożliwiającą atakującemu nadpisanie wbudowanych encji XML (takich jak <, >, &) dowolnymi wartościami. Prowadzi to do obejścia kodowania encji i wykonania ataku XSS w aplikacjach renderujących przetworzone dane XML.

A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability occurs because the regular expression (regex) engine that is used with the Split DNS feature of affected releases may time out when it processes the DNS name list configuration. An attacker could exploit this vulnerability by trying to resolve an address or hostname that the affected device handles. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component:  Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for  Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirect_uri value received as an allowed redirect URI, without escaping characters that have a special meaning in RegEx. Similarly, the documentation did not take this into consideration either. Given a provider with the Redirect URIs set to https://foo.example.com, an attacker can register a domain fooaexample.com, and it will correctly pass validation. authentik 2024.8.5 and 2024.10.3 fix this issue. As a workaround, When configuring OAuth2 providers, make sure to escape any wildcard characters that are not intended to function as a wildcard, for example replace `.` with `\.`.

fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1, the regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit. This type of patch fails to detect cases in which the string representing the attributes of a <script> tag exceeds 100 characters. As a result, most of the regex patterns present in version 3.0.1 can be bypassed. This is fixed in version 3.0.2.

An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access.

An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of `<svg` before the actual SVG root element. When the SVG is subsequently rendered via `@resvg/resvg-js` on the Node.js code path, it renders at the attacker-specified dimensions, potentially causing out-of-memory crashes. In version 9.4.2, the regex-based approach has been replaced with XML-aware processing using `fast-xml-parser` to correctly identify and modify the SVG root element's attributes. Additionally, a `fitTo` constraint has been added to the `renderAsync` call as defense-in-depth, ensuring the rendered output is always bounded regardless of SVG content.

A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.

Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.

The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.

PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Webmin pozwala niezalogowanym atakującym na odczytanie zawartości dowolnego pliku z rozszerzeniem .conf znajdujący się w katalogach modułów, ze względu na możliwy do pominięcia pattern regex.

Budibase to open-source'owa platforma low-code. Przed wersją 3.35.4 funkcje buildMatcherRegex() / matches() w packages/backend-core/src/middleware/matchers.ts kompilują wzorce tras do niezakotwiczonych wyrażeń regularnych i testują je względem ctx.request.url, które zawiera pełny ciąg zapytań. Middleware CSRF w Budibase Worker używa tego systemu dopasowywania, aby zdecydować, czy pominąć walidację tokenu CSRF. Niezauwierzytelniony atakujący może sfałszować żądania zmieniające stan z obcych źródeł wobec dowolnego endpointu Worker API, wstrzykując publiczny wzorzec trasy do ciągu zapytań, co powoduje, że middleware CSRF całkowicie pomija walidację tokenu. Umożliwia to działania takie jak wysyłanie zaproszeń administratora, modyfikowanie konfiguracji globalnej i zarządzanie użytkownikami bez ważnego tokenu CSRF. Podatność ta została naprawiona w wersji 3.35.4.

Projekt Tekton Pipelines udostępnia zasoby w stylu k8s do deklarowania pipelinów CI/CD. W wersjach od 0.43.0 do 1.11.0, polityka weryfikacji zaufanych zasobów porównuje łańcuch źródła zasobu (refSource.URI) względem spec.resources[].pattern przy użyciu regexp.MatchString. W Go funkcja regexp.MatchString zgłasza dopasowanie, jeśli wzorzec pasuje gdziekolwiek w łańcuchu, dlatego typowe nieokotwiczone wzorce (również przykłady z dokumentacji Tekton) można obejść, używając kontrolowanych przez atakującego łańcuchów źródła zawierających zaufany wzorzec jako podłańcuch. Może to spowodować niezamierzone dopasowanie polityki i zmianę aktywnych trybów weryfikacji/kluczy.