GROWI Regular Expression Denial-of-Service Vulnerability

A regular expression denial-of-service (ReDoS) vulnerability has been identified in GROWI, a product of GROWI, Inc. This issue affects GROWI versions through 7.5.0. The vulnerability arises from the User-Agent parsing process, which lacks proper input length restrictions. As a result, an unauthenticated attacker can send crafted long strings that exhaust the server's CPU resources, causing a significant slowdown or complete unresponsiveness of the service. This denial-of-service condition can also delay or timeout requests from other users accessing the service simultaneously.

Impact

Exploitation of this vulnerability allows for a denial-of-service condition, where the server becomes unresponsive or significantly slows down, causing timeouts for users' requests. This disruption can affect multiple users at once, depending on the server's resource management.

Remediation

Users are advised to update GROWI to version 7.5.1 or later. The updated version can be downloaded from GitHub or Docker Hub.