Executive brief
Valine is a popular comment system embedded in websites. An attacker can crash the comment system on a page by submitting a comment with a specially crafted User-Agent header, preventing all other visitors from seeing or loading comments on that page until the malicious comment is removed.
Technical details
Valine 1.4.14 contains a vulnerability in User-Agent (UA) parsing that causes an application crash when processing an incomplete or malformed UA string (e.g., "Mozilla/8.0"). The root cause is improper validation of the UA field during comment processing; the vulnerability allows remote, unauthenticated attackers to submit a comment with a crafted UA value that triggers a fatal error in the comment system. When exploited, the entire comment section on an affected page becomes non-functional until the malicious comment is deleted. The attack requires no authentication and can be triggered via a standard HTTP request to submit a comment.
Affected products
- Valine Valine 1.4.14 and earlier
Timeline
- 2021-06-16: disclosed: Vulnerability reported on GitHub
- 2021-06-21: advisory: GHSA advisory published
- 2021-06-16: other: CVE-2021-34801 assigned