Apereo CAS ResponseEntity redos

Vulnerability

Analysis

CVE-2025-3985 is a vulnerability found in Apereo CAS version 5.2.6, specifically within the management web application component. The issue resides in the ManageRegisteredServicesMultiActionController.java file, in the function ResponseEntity. The vulnerability is classified as problematic due to inefficient regular expression complexity, which arises from the manipulation of the Query argument [1]. This flaw can lead to a regular expression denial of service (ReDoS) condition.

Exploitation

The attack can be initiated remotely without requiring authentication [1]. An attacker can craft a malicious input to the Query argument, causing the regular expression engine to consume excessive CPU resources. The exploit has been publicly disclosed, increasing the likelihood of active exploitation attempts [1].

Impact

Successful exploitation of this vulnerability could allow an attacker to cause a denial of service (DoS) condition against the CAS management web application, potentially affecting availability for legitimate users. The impact is limited to the management interface and does not appear to compromise other CAS services or data confidentiality [1].

Mitigation

As of the latest disclosure, the vendor (Apereo) was contacted but did not respond, and no official patch or workaround has been released for version 5.2.6 [1][2]. Given that version 5.2.6 is an older release, administrators should consider upgrading to a supported version of Apereo CAS and apply any security updates that may address this class of issue [2].