CVE-2021-32763 : Security Advisory and Response

OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the

MessagesController

class of OpenProject has a

quote

method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip

<pre>

tags from the message being quoted. The

(.|\s)

part can match a space character in two ways, so an unterminated

<pre>

tag containing

n

spaces causes Ruby's regex engine to backtrack to try 2^n states in the NFA. This will result in a Regular Expression Denial of Service. The issue is fixed in OpenProject 11.3.3. As a workaround, one may install the patch manually.

Understanding CVE-2021-20657

This CVE relates to a Regular Expression Denial of Service vulnerability in OpenProject forum messages.

What is CVE-2021-20657?

CVE-2021-32763, also known as the Regular Expression Denial of Service in OpenProject forum messages, affects the

MessagesController

class of OpenProject versions prior to 11.3.3. The vulnerability arises from the

quote

method which mishandles

<pre>

tags in the message being quoted.

The Impact of CVE-2021-20657

The vulnerability can lead to Regular Expression Denial of Service, impacting the availability of the OpenProject forum messages system. The base severity is rated as MEDIUM (CVSS score: 4.3), with low attack complexity and vector as NETWORK.

Technical Details of CVE-2021-20657

This section details the vulnerability in OpenProject forum messages.

Vulnerability Description

The issue stems from the mishandling of

<pre>

tags by the

quote

method in the

MessagesController

class, resulting in a Regular Expression Denial of Service.

Affected Systems and Versions

OpenProject versions prior to 11.3.3 are vulnerable to this CVE.

Exploitation Mechanism

By including an unterminated

<pre>

tag with

n

spaces, the vulnerability causes the regex engine to backtrack extensively, leading to a denial of service.

Mitigation and Prevention

To address CVE-2021-32763, it is crucial to take immediate steps and adopt long-term security practices.

Immediate Steps to Take

Update OpenProject to version 11.3.3 or higher to eliminate the vulnerability.
Alternatively, install the patch provided manually as a temporary workaround.

Long-Term Security Practices

Regularly update software to the latest versions to mitigate known vulnerabilities.
Employ secure coding practices to prevent similar issues in the future.

Patching and Updates

Stay informed about security advisories and patches released by OpenProject to maintain a secure environment.