Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-31781

CVE-2022-31781: Apache Tapestry 5.8.1 vulnerable to ReDoS via Content Types causing catastrophic backtracking

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-31781
GHSA ID
GHSA-227g-7cvv-6ff3
EPSS Score
0.77868%
CWE
CWE-400
Published
7/14/2022
Updated
7/24/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.tapestry:tapestry-coremaven< 5.8.25.8.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the regex pattern in ContentType's constructor. The original pattern used '(; (param=value))' with an unbounded quantifier (), which is vulnerable to ReDoS via exponential backtracking. The commit 3c8d610 shows the fix was to limit parameters to {0,5} repetitions. The added test case demonstrates this by triggering a timeout with excessive parameters. Since the constructor directly processes input using this regex, it's the clear vulnerable entry point.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*p**** T*p*stry up to v*rsion *.*.* is vuln*r**l* to R**ul*r *xpr*ssion **ni*l o* S*rvi** (R**oS) in t** w*y it **n*l*s *ont*nt Typ*s. Sp**i*lly *r**t** *ont*nt Typ*s m*y **us* **t*strop*i* ***ktr**kin*, t*kin* *xpon*nti*l tim* to *ompl*t*. Sp**i*i**

Reasoning

T** vuln*r**ility st*ms *rom t** r***x p*tt*rn in *ont*ntTyp*'s *onstru*tor. T** ori*in*l p*tt*rn us** '(; (p*r*m=v*lu*))*' wit* *n un*oun*** qu*nti*i*r (*), w*i** is vuln*r**l* to R**oS vi* *xpon*nti*l ***ktr**kin*. T** *ommit ******* s*ows t** *ix