GL.iNet Routers API ReDoS Vulnerability

A vulnerability allowing for a Regular Expression Denial-of-Service (ReDoS) attack has been identified in multiple GL.iNet router models running version 4.x. This vulnerability arises from the API component, where inefficient regular expression processing can be exploited to cause high CPU usage, leading to degraded device performance. The issue can be triggered without authentication by sending a specially crafted request to the API that includes certain character parameters, causing the router's code to enter an infinite loop.

Impact

Exploitation of this vulnerability causes excessive CPU usage, disrupting normal router functionality.

Reproduction

The vulnerability can be reproduced by sending a POST request to the router's RPC API endpoint. The request must include a payload that specifies the 'load_locales' method and a locale parameter filled with special characters. This can be done using a command-line tool like curl.

Remediation

Users are advised to upgrade their routers to the latest firmware version that addresses this vulnerability.