jquery-validationにおける正規表現によるサービス拒否 (Regular Expression Denial of Service)

A ReDoS attack exploits inefficient regular expressions, causing them to consume excessive CPU resources and potentially crash the application or server. In the context of jQuery.Validation, an attacker could craft malicious input that triggers these vulnerable regular expressions, leading to a denial of service for users relying on the library. The impact can range from temporary website unavailability to complete system outages, depending on the deployment and load. While the vulnerability itself doesn't directly expose sensitive data, the resulting DoS can be used as a distraction for other malicious activities.

Web applications and websites that utilize jQuery.Validation versions prior to 1.19.3 are at risk. This includes applications built on .NET frameworks that incorporate jQuery.Validation for form validation. Shared hosting environments where multiple applications share the same jQuery.Validation library are particularly vulnerable, as a compromise of one application could affect others.

• .NET / web: Monitor application logs for excessive CPU usage or crashes related to regular expression processing. Use performance monitoring tools to identify slow or unresponsive regular expression calls.

Get-Process | Where-Object {$_.CPU -gt 100} | Select-Object Name, CPU

• .NET / web: Inspect the jQuery.Validation source code for regular expressions that match known ReDoS patterns. Use static analysis tools to identify potential vulnerabilities. • generic web: Examine web server access logs for unusual patterns of requests that might indicate an attacker attempting to trigger ReDoS.

1. 2021-01-13Disclosure

   disclosure

1. 予約済み2020-12-22
2. 公開日2021-01-13
3. 更新日2026-03-13
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2021-21252 is to upgrade jQuery.Validation to version 1.19.3 or later, which contains the fix for the vulnerable regular expressions. If immediate upgrading is not feasible, consider implementing input validation and sanitization techniques to prevent malicious input from reaching the vulnerable regular expressions. Web Application Firewalls (WAFs) with regular expression filtering capabilities can also provide a temporary layer of protection. After upgrading, confirm the fix by testing the application with various input strings, including those known to trigger ReDoS vulnerabilities.