GROWI Inefficient Regular Expression Complexity Leading to Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in GROWI, prior to version 7.1.6, due to inefficient regular expressions. This issue allows a logged-in user to create a condition that disrupts normal service.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the application to become unresponsive or unavailable.

Reproduction

The vulnerability can be reproduced by a logged-in user who creates a page with a path that includes more than 130 consecutive slashes. This can be done either through the page tree or by using a permalink. GROWI will return an error message, but the application may become sluggish, making it impractical to create such a deep hierarchy under normal circumstances.

Remediation

Users are advised to update GROWI to version 7.1.6 or later.