Executive brief
Wagtail is a popular open-source content management system. A flaw in how it processes search queries allows an attacker to send a specially crafted, long search term that causes the server to become unresponsive. This can lead to a denial-of-service (DoS) condition, making the website or its administration panel unavailable to users.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Wagtail's 'parse_query_string' function due to inefficient regular expression complexity (CWE-1333). When the function processes long strings of characters without spaces, it incurs catastrophic backtracking, leading to excessive CPU consumption. In a default configuration, the attack requires 'admin' level privileges to exploit via the Wagtail admin interface; however, if a site uses 'parse_query_string' in custom public-facing search implementations, it could be exploited by unauthenticated users. The issue is mitigated in versions 5.2.6, 6.0.6, and 6.1.3. A temporary workaround involves limiting search term inputs to under 1000 characters.
Affected products
- Wagtail Wagtail >= 2.0, < 5.2.6; >= 6.0, < 6.0.6; >= 6.1, < 6.1.3
Timeline
- 2024-07-11: disclosed
- 2024-07-11: patched
- 2024-07-11: advisory