Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

Vulnerability

In GraphHopper versions 2.0 through 2.3, the navigate module uses an unsanitized profile parameter in a regex operation (replaceFirst and replaceAll) on the request URL [1][3]. An attacker can inject a special regex pattern that causes exponential backtracking (ReDoS), leading to a Denial of Service. The vulnerability exists in the getPointsFromRequest method of NavigationResource.java [4].

Exploitation

The attacker sends a crafted HTTP request to the navigate endpoint with a malicious profile string that triggers catastrophic backtracking in the Java regex engine [1][3]. No authentication is required, and the request can be made remotely. The only condition is that the request must reach the affected method, which processes the URL path using replaceFirst and replaceAll with the attacker-controlled profile value [4].

Impact

Successful exploitation causes high CPU consumption on the server, leading to a Denial of Service (DoS) as the thread handling the request hangs or becomes unresponsive. This impacts availability of the routing service [2][3]. No data confidentiality or integrity is compromised.

Mitigation

The fix was released in versions 2.4 and 3.0 [1][2]. The patch replaces the regex-based URL manipulation with simple string operations (startsWith and substring) which are not vulnerable to injection [4]. Users should upgrade to at least version 2.4. There is no known workaround for unpatched versions.