Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-39229

CVE-2021-39229:
Apprise vulnerable to regex injection with IFTTT Plugin

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-39229
GHSA ID
GHSA-qhmp-h54x-38qr
EPSS Score
0.62544%
CWE
CWE-400
Published
9/20/2021
Updated
9/12/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
apprisepip<= 0.9.40.9.5.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the regex pattern in parse_native_url() that handled IFTTT URL parsing. The original regex allowed arbitrary repetition of event components without proper path segment separation, enabling regex injection. The commit diff shows the critical fix changing '(event components)+' to explicit path segments with '(/[pattern]+)+', addressing the backtracking vulnerability. This function directly processes user-supplied URLs, making it the attack vector for resource exhaustion.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *nyon* _pu*li*ly_ *ostin* t** *ppris* li*r*ry *n* *r*ntin* t**m ****ss to t** I*TTT noti*i**tion s*rvi**. ### P*t***s Up**t* to *ppris* v*.*.*.* ```**s* # Inst*ll *ppris* v*.*.*.* *rom PyPI pip inst*ll *ppris*==*.*.*.* ``` T*

Reasoning

T** vuln*r**ility st*ms *rom t** r***x p*tt*rn in p*rs*_n*tiv*_url() t**t **n*l** I*TTT URL p*rsin*. T** ori*in*l r***x *llow** *r*itr*ry r*p*tition o* *v*nt *ompon*nts wit*out prop*r p*t* s**m*nt s*p*r*tion, *n**lin* r***x inj**tion. T** *ommit *i**