CVE-2021-22880

Vulnerability

Overview

CVE-2021-22880 is a regular expression denial of service (ReDoS) vulnerability in the PostgreSQL adapter of Active Record, a component of Ruby on Rails. The flaw resides in the input validation logic for the money type column. Specially crafted input can cause the regular expression engine to spend excessive time processing, leading to a denial of service condition [1][3].

Exploitation and

Attack Surface

To exploit this vulnerability, an attacker must be able to supply input to a Rails application that uses PostgreSQL with a money type column. The attacker does not need prior authentication; the attack can be carried out by sending a malicious payload through a form or API endpoint that is processed by the affected adapter. The regular expressions in the cast_value method, particularly the patterns used to parse monetary values, are the root cause of the ReDoS [3].

Impact

Successful exploitation results in a denial of service, where the affected Rails application spends disproportionate CPU time evaluating the regular expression. This can render the application unresponsive, impacting availability. The vulnerability affects all Rails versions from 4.2.0 up to (but not including) the fixed releases [3].

Mitigation

Patches have been released for the supported versions: 6.1.2.1, 6.0.3.5, and 5.2.4.5. Users who cannot immediately upgrade can apply a provided monkey patch in an initializer as a workaround. Users of unsupported versions (prior to 4.2.0 or older than 5.2) are advised to upgrade to a supported release [2][3].