| Título | Apereo CAS v5.2.6 ReDos Denial of Service |
|---|
| Descrição | 1.Vulnerability Name: Apereo CAS V5.2.6 application has a ReDos denial of service attack vulnerability
2.Vulnerability level : Medium risk.
3.Vulnerability submitter and contributor: 蔡超雄 (caichaoxiong)
4.Affects : v5.2.6
5.Vulnerability Description:
ReDoS (Regular Expression Denial of Service) vulnerability :
Defects of the regular expression engine . The attacker constructs special input data to cause a large number of backtracking operations in the regular expression matching process, thereby consuming server resources, reducing system performance, and even causing service unavailability .
Apereo CAS (Central Authentication Service) is an open source identity authentication and authorization system, which is widely used in single sign-on (SSO) solutions for enterprise-level Web applications at home and abroad. According to tests and verification, the status/configmetadata/search interface of Apereo CAS v5.2.6 can trigger the ReDoS denial of service attack vulnerability by carefully constructing malicious regular expressions because the name parameter is controllable, thereby exhausting server resources .
6.Vulnerability Threats
Hackers can send a large number of requests with malicious regular expressions, causing all threads in the server thread pool to execute regular expression matching, consuming a large amount of CPU resources, making it impossible to respond to normal user requests, resulting in a DoS denial of service attack. |
|---|
| Fonte | ⚠️ https://wx.mail.qq.com/s?k=rk-m8GwRMVMcOjBY1a |
|---|
| Utilizador | caichaoxiong (UID 84060) |
|---|
| Submissão | 14/04/2025 08h01 (há 1 Ano) |
|---|
| Moderação | 26/04/2025 10h07 (12 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 306322 [Apereo CAS 5.2.6 CasConfigurationMetadataServerController.java Nome Negação de Serviço] |
|---|
| Pontos | 17 |
|---|