Incorrect Regular Expression in validator.js - CVE-2021-3765

Vulnerability identifier: #VU68281

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3765

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a regular expression denial of service (ReDoS) attack.

The vulnerability exists due to improper input validation when handling user-supplied input. A remote attacker can pass specially crafted data to the application and perform a regular expression denial of service (ReDoS) attack.

validator.js
QRadar Pulse App
IBM Cloud Transformation Advisor
Netcool Operations Insight
QRadar User Behavior Analytics
OpenShift Data Foundation (formerly OpenShift Container Storage)
webMethods Managed File Transfer
IBM Planning Analytics Workspace
QRadar Assistant
Contrail Networking

Install updates from vendor's website.

validator.js - update to 13.7.0
QRadar Pulse App - update to 2.2.9
IBM Cloud Transformation Advisor - update to 3.1.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.12.10, 4.13.0
Contrail Networking - update to R22.3
Netcool Operations Insight - update to 1.6.6
IBM Planning Analytics Workspace - update to 2.0.93
QRadar Assistant - update to 3.6.0
QRadar User Behavior Analytics - update to 4.1.11

• https://huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9
• https://github.com/validatorjs/validator.js/commit/496fc8b2a7f5997acaaec33cc44d0b8dba5fb5e1

• Regular expression denial of service in validator.js
• Multiple vulnerabilities in Juniper Networks Contrail Networking
• Multiple vulnerabilities in IBM QRadar Pulse for QRadar SIEM
• Multiple vulnerabilities in Netcool Operations Insight
• Incorrect regular expression in IBM QRadar Assistant
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.12
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM webMethods Managed File Transfer