Description
The Clientside Validation module adds client side validation to forms, and provides a server side AJAX fallback so that pattern based rules can still be checked when the browser cannot evaluate them.
The callback that performs this fallback is reachable by any visitor who can view content, and it reads the list of patterns and the subject value straight from the request before handing them to the regular expression engine, without confirming that the patterns are ones the site itself generated. An attacker can therefore submit any pattern and any subject, and a pattern written to backtrack catastrophically forces the server to spend processing time up to the configured backtracking ceiling on each request, with no token and no rate limit standing in the way.
This vulnerability is mitigated by the fact that the pattern matching effort of a single request is bounded by the PCRE backtracking limit, so the impact is elevated server processing rather than an unbounded hang or code execution.
Solution
Install the latest version.
If you use the Clientside Validation module for Drupal 7, upgrade to Clientside Validation 7.x-1.51:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES