Executive brief
Foundation is a widely-used front-end framework for building responsive websites. The framework contains regular expressions vulnerable to ReDoS (Regular Expression Denial of Service), which allows attackers to cause application slowdowns or service unavailability by sending specially crafted input that triggers excessive processing. This vulnerability affects versions 6.3.3 and earlier.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) issue caused by one or more inefficiently-designed regular expressions in Foundation (CWE-1333). The vulnerable regex patterns can be exploited by supplying input that causes catastrophic backtracking, leading to CPU exhaustion and denial of service. The attack is network-reachable and requires no authentication or user interaction; an attacker can trigger the vulnerability by submitting malicious input to an affected application. As of the advisory publication, no patch status was explicitly confirmed, though the issue was reported against version 6.3.3 and prior.
Affected products
- Foundation Foundation Sites 6.3.3 and prior
Timeline
- 2024-10-26: disclosed
- 2020: other: Original disclosure as GHSL-2020-290