CVE-2021-31409: Regular expression Denial of Service (ReDoS) in Vaadin 8 EmailValidator

Background

Vaadin is an open-source Java framework used for building modern web applications. The com.vaadin:vaadin-compatibility-server package is a compatibility module in Vaadin 8 that provides support for older versions. The EmailValidator class in this module is responsible for validating email addresses. However, versions 8.0.0 through 8.12.4 of this package contain an unsafe validation regular expression (RegEx) that can be exploited by attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

Vulnerability Detail

The vulnerability in the EmailValidator class allows for a Regular expression Denial of Service (ReDoS) attack. By submitting specially crafted email addresses, an attacker can trigger a ReDoS scenario where the regular expression used for validation takes an excessive amount of time to process. This can lead to a denial of service condition, causing high CPU usage and potentially impacting the availability of the application. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.

Workaround

If upgrading to the fixed version is not immediately possible, a temporary workaround can be implemented by manually validating email addresses using a different, safe regular expression or a dedicated email validation library. Here is an example of how to use the Apache Commons Validator library for email validation:

import org.apache.commons.validator.routines.EmailValidator;

public class EmailValidationExample {

    public static void main(String[] args) {
        String email = "test@example.com";
        boolean isValid = EmailValidator.getInstance().isValid(email);
        System.out.println("Is email valid? " + isValid);
    }
}

Conclusion

The com.vaadin:vaadin-compatibility-server package in Vaadin 8 is vulnerable to a Regular expression Denial of Service (ReDoS) attack in the EmailValidator class. Upgrading to version 8.13.0 or later is recommended to fix this vulnerability. If immediate upgrade is not possible, implementing a temporary workaround by using a different email validation approach can help mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for com.vaadin:vaadin-compatibility-server →

FAQ