Apache DolphinScheduler user registration is vulnerable to ReDoS attacks

Vulnerability

The user registration module in Apache DolphinScheduler prior to version 2.0.5 contains a Regular Expression Denial of Service (ReDoS) flaw. The vulnerability arises from an inefficient regex pattern used during user registration input validation, which can lead to catastrophic backtracking when processing crafted input strings [1], [2].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted registration request with a malicious payload. The regex engine will attempt to match the input, consuming excessive CPU time and potentially causing the service to become unresponsive. No special privileges or network position is required beyond network access to the registration endpoint [2].

Impact

Successful exploitation results in a denial of service (DoS) condition, impacting the availability of the Apache DolphinScheduler instance. While no data compromise or privilege escalation occurs, the service may be rendered unusable for legitimate users until restarted [2].

Mitigation

The issue is fixed in Apache DolphinScheduler version 2.0.5, released on March 30, 2022. Users are advised to upgrade immediately. No workarounds are documented [2], [3].