Apereo CAS CasConfigurationMetadataServerController.java redos

Analysis

A vulnerability classified as problematic exists in Apereo CAS version 5.2.6, specifically in the file CasConfigurationMetadataServerController.java within the core module. The root cause is the manipulation of the argument Name, which leads to inefficient regular expression complexity (ReDoS). This type of flaw occurs when a crafted input causes the regular expression engine to backtrack excessively, consuming significant CPU time and potentially stalling the server. [1]

Exploitation

The attack can be initiated remotely without authentication prerequisites, as the affected controller endpoint is accessible over the network. An attacker only needs to send a specifically crafted request to the vulnerable endpoint, providing a payload that triggers the inefficient regex pattern. The exploit has been publicly disclosed, increasing the risk of active exploitation. [1]

Impact

Successful exploitation allows an attacker to cause a denial of service (DoS) condition by exhausting server resources. This can lead to legitimate users being unable to access CAS services, affecting authentication and single sign-on operations for the entire deployment. The impact is limited to availability, as the vulnerability is categorized as 'problematic' and does not lead to data leakage or code execution. [1]

Mitigation

As of the publication date, the vendor (Apereo) has not responded to early disclosure and no official patch or workaround has been provided. Users are advised to monitor the official CAS repository [2] for any future fixes. Upgrade to a newer version of CAS, if available, or implement web application firewall (WAF) rules to filter malicious inputs targeting this endpoint.