Inefficient regular expression complexity in Nautobot - #VU155750

Vulnerability details

The vulnerability allows a remote privileged user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in Nautobot's custom field validation_regex evaluation when validating submitted values during object creation and updates. A remote privileged user can configure a pattern that exhibits catastrophic backtracking and submit nonmatching values concurrently to cause a denial of service.

Configuring a custom field requires the extras.add_customfield or extras.change_customfield permission. Evaluation is reached through the web UI, REST API, GraphQL mutations, CSV import and Jobs. The configured pattern applies to all users of the instance, and the person who configured it need not be present when it triggers.

Affected software

Remediation

External References

• https://github.com/nautobot/nautobot/security/advisories/GHSA-gffr-x2x7-7fgh
• https://github.com/nautobot/nautobot/commit/82b6d102cb880c59a6236e9bec94f36ac43d14c7

Related Security Bulletins

• Multiple vulnerabilities in Nautobot