{"id":"GHSA-8w7w-67mw-r5p7","aliases":[],"status":"published","title":"generator-jhipster vulnerable to login check Regular Expression Denial of Service","description":"### Impact\nFor applications using JWT or session-based authentication (not OIDC), users can input a login string which can cause a denial of service, as parsing it will be too complex.\n\nHere is an example: https://gist.github.com/atomfrede/311f8a9c6eb74c5c5226af0481155207\n\nThe vulnerable expression was never officially released. So only when you generated an application from the master branch between 6.8.0 and 6.9.0 your generated application may be vulnerable.\n\n### Patches\n\nIf you only used official releases you don't need to patch your application.\n\n### Workarounds\n\nIf you have created an application from the master branch, you need to adapt the `LOGIN_REGEX` in `Constants.java`. If your regex is \n```\n^[a-zA-Z0-9!#$\u0026'*+=?^_`{|}~.-]+@?[a-zA-Z0-9-]+(?:\\\\.[a-zA-Z0-9-]+)*$\n```\nyou need to change it too \n```\n^(?\u003e[a-zA-Z0-9!$\u0026*+=?^_`{|}~.-]+@[a-zA-Z0-9-]+(?:\\\\.[a-zA-Z0-9-]+)*)|(?\u003e[_.@A-Za-z0-9-]+)$\n```\n \nIf you still have `^[_.@A-Za-z0-9-]*$` there is no need to change it, except you would like to support login with `+` sign (e.g. `foo+bar@example.com`).\n\n### References\n\n* https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS\n* https://snyk.io/blog/redos-and-catastrophic-backtracking/","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2022-10-06T22:56:29Z","modified":"2023-01-12T05:05:36Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"generator-jhipster","ranges":[{"type":"UNPARSED","raw":"\u003e 6.8.0, \u003c 6.9.0","events":[]}]}],"references":[{"url":"https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-8w7w-67mw-r5p7"},{"url":"https://gist.github.com/atomfrede/311f8a9c6eb74c5c5226af0481155207"},{"url":"https://www.jhipster.tech/2020/05/17/jhipster-release-6.9.0.html"},{"url":"https://github.com/advisories/GHSA-8w7w-67mw-r5p7"}],"sources":{"ghsa":[{"id":"GHSA-8w7w-67mw-r5p7","title":"generator-jhipster vulnerable to login check Regular Expression Denial of Service","description":"### Impact\nFor applications using JWT or session-based authentication (not OIDC), users can input a login string which can cause a denial of service, as parsing it will be too complex.\n\nHere is an example: https://gist.github.com/atomfrede/311f8a9c6eb74c5c5226af0481155207\n\nThe vulnerable expression was never officially released. So only when you generated an application from the master branch between 6.8.0 and 6.9.0 your generated application may be vulnerable.\n\n### Patches\n\nIf you only used official releases you don't need to patch your application.\n\n### Workarounds\n\nIf you have created an application from the master branch, you need to adapt the `LOGIN_REGEX` in `Constants.java`. If your regex is \n```\n^[a-zA-Z0-9!#$\u0026'*+=?^_`{|}~.-]+@?[a-zA-Z0-9-]+(?:\\\\.[a-zA-Z0-9-]+)*$\n```\nyou need to change it too \n```\n^(?\u003e[a-zA-Z0-9!$\u0026*+=?^_`{|}~.-]+@[a-zA-Z0-9-]+(?:\\\\.[a-zA-Z0-9-]+)*)|(?\u003e[_.@A-Za-z0-9-]+)$\n```\n \nIf you still have `^[_.@A-Za-z0-9-]*$` there is no need to change it, except you would like to support login with `+` sign (e.g. `foo+bar@example.com`).\n\n### References\n\n* https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS\n* https://snyk.io/blog/redos-and-catastrophic-backtracking/","status":"published","published":"2022-10-06T22:56:29Z","modified":"2023-01-12T05:05:36Z","updated_at":"2026-11-02T14:36:14.033357Z"}]}}