GHSA-jmp3-39vp-fwg8 CVE-2024-39317 PYSEC-2024-86
Wagtail regular expression denial-of-service via search query parsing
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.61%
- Chance of exploitation in the next 30 days. Higher than 49.48% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
6.0.6- Upgrade wagtail to this version or later
Description
Impact
A bug in Wagtail's parse_query_string would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, parse_query_string would take an unexpectedly large amount of time to process, resulting in a denial of service.
In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses parse_query_string, it may be exploitable by other users (e.g. unauthenticated users).
Patches
Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.
This vulnerability affects all unpatched versions from Wagtail 2.0 onwards.
Workarounds
Site owners who are unable to upgrade to a patched version can limit the length of search terms passed to parse_query_string. Whilst the performance characteristics will depend on your hosting environment, 1000 characters has been shown to still be fairly fast, without triggering this vulnerability.
No workaround is available for the Wagtail admin usage.
Acknowledgements
Many thanks to Jake Howard for reporting this issue.
For more information
If you have any questions or comments about this advisory:
- Visit Wagtail's support channels
- Email us at security@wagtail.org (view our security policy for more information).
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| wagtail | >= 6.0, < 6.0.6 |
6.0.6 |
| wagtail | >= 6.1, < 6.1.3 |
6.1.3 |
| wagtail | >= 2.0, < 5.2.6 |
5.2.6 |
| wagtail | >= 6.0, < 6.0.6>= 6.1, < 6.1.3>= 2.0, < 5.2.6 |
5.2.66.0.66.1.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
wagtail PyPI → 6.0.6
- pip
pip install --upgrade "wagtail>=6.0.6"- poetry
poetry add "wagtail>=6.0.6"- uv
uv add "wagtail>=6.0.6"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Packages
Other links
- github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8
- github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2
- github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797
- github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2
- github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2024-86.yaml
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-jm5p-837g-rv8g Wagtail: Improper restriction handling on Page translation API endpoint | Medium | Also affects wagtail |
| GHSA-x5cx-w6p2-mxf2 Wagtail: Improper permission handling when copying snippets | Medium | Also affects wagtail |
| GHSA-c2xx-cjmh-9q8f Wagtail: Improper restriction handling on descendant collections in Documents and Images API | Medium | Also affects wagtail |
| GHSA-92hv-j533-69wc Wagtail: Identification of documents by SHA1 hash | Low | Also affects wagtail |
| GHSA-3vrh-m9w7-v94f Wagtail: Improper restriction handling on Pages admin API | Medium | Also affects wagtail |
| GHSA-23m2-mghx-vqmf Wagtail: Reflected XSS in dynamic image URL generator view | High | Also affects wagtail |
| GHSA-8634-mr4j-r72c Wagtail: Pages translations can be created without page permissions when using simple_translation | Medium | Also affects wagtail |
| GHSA-r6p4-grq7-xm4m Wagtail: Improper permission handling in image preview | Medium | Also affects wagtail |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor