Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

See CWE-400: Uncontrolled Resource Consumption

Description

Regular expression used on server side to validate input of email fields (com.vaadin.v7.data.validator.EmailValidator) is subjected to exponential backtracking, which may result in unbound resource consumption and Denial of Service. To perform such an attack it is enough to enter a malicious email address into any email field and submit a value to the server for validation. UI thread of the server can spend an indefinite amount of time (depending on the input) matching this email address to a validation pattern. By repeating this action the attacker may cause thread pool or resource exhaustion, thus making the application unresponsive for normal users.

Affected products and mitigation

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Artifacts

Credit

This issue was discovered and responsibly reported by Stefan Penndorf.

References

• Issue: https://github.com/vaadin/framework/issues/12240
• PR: https://github.com/vaadin/framework/pull/12241