title: regex injection leading to DoS
description: User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
product: Apache Roller
vendor: Apache Software Foundation
versions:
lessThan: 6.0.2, status: affected, version: Apache Roller, versionType: custom
}
metrics:
other: [
content: {'other': 'Low: This attack will only work if Banned-words Referrer processing is turned on in Roller and it is off-by-default.'}
type: unknown
]
workarounds: This problem has been fixed in Roller 6.0.2. If you are not able to upgrade then you can "work around" the problem.
If Banned-Words Referrer processing is enabled and you are concerned about this type of attack then disable it.
In the Roller properties, set this property site.bannedwordslist.enable.referrers=false