CVE-2021-29061
📋 TL;DR
This CVE describes a Regular Expression Denial of Service (ReDoS) vulnerability in vfsjfilechooser2 library versions 0.2.9 and below. Attackers can craft malicious URIs that cause excessive CPU consumption when validated, leading to application unresponsiveness. This affects any application using the vulnerable vfsjfilechooser2 component for file selection operations.
💻 Affected Systems
- vfsjfilechooser2
📦 What is this software?
Vfsjfilechooser2 by Vfsjfilechooser2 Project
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service causing application unavailability, potentially affecting dependent services and requiring system restart.
Likely Case
Degraded application performance or temporary unresponsiveness when processing malicious URIs.
If Mitigated
Minimal impact with proper input validation and updated library versions.
🎯 Exploit Status
Exploitation requires ability to provide crafted URIs to the vulnerable component, typically through user input or API calls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: vfsjfilechooser2-0.2.10 and above
Vendor Advisory: https://github.com/fracpete/vfsjfilechooser2/releases/tag/vfsjfilechooser2-0.2.10
Restart Required: Yes
Instructions:
1. Update vfsjfilechooser2 dependency to version 0.2.10 or higher. 2. Rebuild and redeploy affected applications. 3. Restart application services.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation to reject malformed URIs before they reach the vulnerable component.
Implement URI validation using whitelist patterns or length limits
Rate Limiting
allApply rate limiting to URI processing functions to prevent sustained DoS attacks.
Configure application-level rate limiting for file chooser operations
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy WAF rules to block malicious URI patterns
🔍 How to Verify
Check if Vulnerable:
Check application dependencies for vfsjfilechooser2 version 0.2.9 or earlier.Check Version:
Check Maven/Gradle dependencies or examine JAR manifest: java -jar vfsjfilechooser2.jar --versionVerify Fix Applied:
Confirm vfsjfilechooser2 version is 0.2.10 or higher in application dependencies.📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- Application timeouts during file selection operations
- Stack traces containing regex processing errors
Network Indicators:
- Unusual patterns of URI requests to file chooser endpoints
SIEM Query:
source="application.logs" AND ("CPU spike" OR "timeout" OR "ReDoS") AND process="java"🔗 References
- https://github.com/fracpete/vfsjfilechooser2/commit/9c9f2c317f3de5ece60a3ae28c371e9796e3909b
- https://github.com/fracpete/vfsjfilechooser2/issues/7
- https://github.com/fracpete/vfsjfilechooser2/releases/tag/vfsjfilechooser2-0.2.9
- https://github.com/yetingli/PoCs/blob/main/CVE-2021-29061/Vfsjfilechooser2.md
- https://github.com/yetingli/SaveResults/blob/main/md/vfsjfilechooser2.md
- https://github.com/fracpete/vfsjfilechooser2/commit/9c9f2c317f3de5ece60a3ae28c371e9796e3909b
- https://github.com/fracpete/vfsjfilechooser2/issues/7
- https://github.com/fracpete/vfsjfilechooser2/releases/tag/vfsjfilechooser2-0.2.9
- https://github.com/yetingli/PoCs/blob/main/CVE-2021-29061/Vfsjfilechooser2.md
- https://github.com/yetingli/SaveResults/blob/main/md/vfsjfilechooser2.md
