HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.9.4.2, 6.9.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- hapifhir org.hl7.fhir.core
fixed in 6.9.4.2; From 6.9.5 · fixed in 6.9.9
- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2Maven
From 6.9.5 · fixed in 6.9.9
- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016mayMaven
From 6.9.5 · fixed in 6.9.9
- ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Maven
From 6.9.5 · fixed in 6.9.9
- ca.uhn.hapi.fhir:org.hl7.fhir.r4Maven
From 6.9.5 · fixed in 6.9.9
- ca.uhn.hapi.fhir:org.hl7.fhir.r4bMaven
From 6.9.5 · fixed in 6.9.9
- ca.uhn.hapi.fhir:org.hl7.fhir.r5Maven
From 6.9.5 · fixed in 6.9.9
- ca.uhn.hapi.fhir:org.hl7.fhir.validationMaven
From 6.9.5 · fixed in 6.9.9
- ca.uhn.hapi.fhir:org.hl7.fhir.validation.cliMaven
From 6.9.5 · fixed in 6.9.9
- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2Maven
fixed in 6.9.4.2
- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016mayMaven
fixed in 6.9.4.2
- ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Maven
fixed in 6.9.4.2
- ca.uhn.hapi.fhir:org.hl7.fhir.r4Maven
fixed in 6.9.4.2
- ca.uhn.hapi.fhir:org.hl7.fhir.r4bMaven
fixed in 6.9.4.2
- ca.uhn.hapi.fhir:org.hl7.fhir.r5Maven
fixed in 6.9.4.2
- ca.uhn.hapi.fhir:org.hl7.fhir.validationMaven
fixed in 6.9.4.2
- ca.uhn.hapi.fhir:org.hl7.fhir.validation.cliMaven
fixed in 6.9.4.2