Vulnerability · Published Jul 20, 2021 · Assigned by GitHub_M

CVE-2021-32763Regular Expression Denial of Service in OpenProject forum messages

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in openproject from opf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.9%top 39.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip `<pre>` tags from the message being quoted. The `(.|\s)` part can match a space character in two ways, so an unterminated `<pre>` tag containing `n` spaces causes Ruby's regex engine to backtrack to try 2<sup>n</sup> states in the NFA. This will result in a Regular Expression Denial of Service. The issue is fixed in OpenProject 11.3.3. As a workaround, one may install the patch manually.

Affected products (as reported)

Vendor	Product	Versions
opf	openproject	< 11.3.3

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/opf/openproject/security/advisories/GHSA-qqvp-j6gm-q56f x_refsource_CONFIRM
https://github.com/opf/openproject/pull/9447.patch x_refsource_MISC