CVE-2022-26650
📋 TL;DR
This vulnerability in Apache ShenYu allows attackers to cause resource exhaustion (denial of service) by injecting malicious regular expressions into user-controllable parameters. The Pattern.matches() function can be exploited with crafted regex patterns that cause excessive backtracking, consuming CPU resources. This affects Apache ShenYu versions 2.4.0 through 2.4.2.
💻 Affected Systems
- Apache ShenYu (incubating)
- ShenYu-Bootstrap
📦 What is this software?
Shenyu by Apache
Shenyu by Apache
Shenyu by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting all users of the application.
Likely Case
Degraded performance or intermittent service disruptions affecting specific endpoints.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Exploitation requires crafting regex patterns that cause excessive backtracking (ReDoS).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.3
Vendor Advisory: https://lists.apache.org/thread/8rp33m3nm4bwtx3qx76mqynth3t3d673
Restart Required: Yes
Instructions:
1. Upgrade Apache ShenYu to version 2.4.3 or later. 2. Replace the vulnerable RegexPredicateJudge.java with the patched version. 3. Restart the ShenYu service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement regex pattern validation to reject complex patterns before they reach Pattern.matches()
Timeout Configuration
allConfigure regex execution timeouts to limit resource consumption
🧯 If You Can't Patch
- Implement WAF rules to block regex patterns with excessive complexity
- Rate limit requests to vulnerable endpoints to reduce attack impact
🔍 How to Verify
Check if Vulnerable:
Check if Apache ShenYu version is 2.4.0, 2.4.1, or 2.4.2 by examining the application version in configuration files or via admin interface.Check Version:
Check application configuration files or use: grep -r "2.4.[0-2]" /path/to/shenyu/config/Verify Fix Applied:
Confirm version is 2.4.3 or later and verify that RegexPredicateJudge.java no longer passes user input directly to Pattern.matches() without validation.📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- Pattern.matches() execution timeouts
- Repeated regex evaluation failures
Network Indicators:
- Unusually large regex patterns in HTTP parameters
- Multiple rapid requests to regex evaluation endpoints
SIEM Query:
source="shenyu" AND (cpu_usage>90 OR error="timeout" OR message="Pattern.matches")