CVE-2021-41118 ReDoS in DynamicPageList3
Attackers can cause denial of service in MediaWiki sites using DynamicPageList3 by submitting malicious regex patterns in parser function parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-41118?
CVE-2021-41118 is a medium-severity denial of service vulnerability in Universal-Omega DynamicPageList3, published on 4 Oct 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised input of regular expression date within the parameters of the DPL parser function, allowed for the possibility of ReDoS (Regex Denial of Service). This has been resolved in version 3.3.6. If you are unable to update you may also set `$wgDplSettings['functionalRichness'] = 0;` or disable DynamicPageList3 to mitigate.
Weakness: CWE-400
Which versions are affected by CVE-2021-41118?
It affects 1 product.
Products include Dynamicpagelist3 Project Dynamicpagelist3.
How do I fix CVE-2021-41118?
No fix has been published for CVE-2021-41118 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-41118 being exploited?
There is no known exploitation of CVE-2021-41118 in the wild and no public exploit code.
Sources
Also known as GHSA-8f24-q75c-jhf4.