aaPanel Regular Expression Denial-of-Service Vulnerability

A Regular Expression Denial-of-Service (ReDoS) vulnerability has been identified in aaPanel version 7.57.0. The issue arises in the VirtualHost configuration parser, where a backtracking-prone regular expression is used to match <VirtualHost ... :> blocks. This pattern can be exploited by supplying crafted input, leading to excessive CPU usage or process timeouts.

Impact

Exploitation of this vulnerability causes a Regular Expression Denial-of-Service, where the server's CPU is subjected to excessive load, potentially leading to timeouts or degraded performance.

Reproduction

The vulnerability can be reproduced by uploading a configuration file or input that includes long, repetitive strings designed to trigger the backtracking in the regular expression. This can be done through the aaPanel interface that accepts such configurations.