This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Nature**: Regular Expression Denial of Service (ReDoS) vulnerability.
💥 **Consequence**: Attackers can exhaust server computational resources by constructing malicious regular expressions, rendering the service unava…
🔍 **Defect Point**: The validation logic in `is_safe_regex_pattern` within the `search_code_advanced` function is flawed.
📉 **CWE**: Regular Expression Denial of Service (ReDoS), failure to effectively limit regex comple…
📦 **Component**: `code-index-mcp` project.
🏷️ **Version**: All versions **≤ 2.14.0** are affected.
Q4What can hackers do? (Privileges/Data)
🛑 **Privilege**: Triggerable with **Low Privilege (PR:L)**.
📊 **Data**: Does not steal data; primarily impacts **Availability (A:L)**, causing service瘫痪 (paralysis).
Q5Is exploitation threshold high? (Auth/Config)
🔑 **Threshold**: Medium.
⚙️ **Configuration**: Requires **Network Access (AV:N)**, but requires **Local/Low Privilege Authentication (PR:L)**, and needs no User Interaction (UI:N).
Q6Is there a public Exp? (PoC/Wild Exploitation)
💣 **Exploit**: **Yes**.
📢 **Status**: Attack code is publicly available (refer to GitHub Issue #84), posing a risk of in-the-wild exploitation.
Q7How to self-check? (Features/Scanning)
🔎 **Self-Check**: Check if `code-index-mcp` is used and the version is below 2.14.1.
🛡️ **Scanning**: Monitor the `regex` parameter input of the `search_code_advanced` interface to detect malicious regex construction.
Q8Is it fixed officially? (Patch/Mitigation)
✅ **Fixed**.
🔧 **Patch**: Upgrade to **v2.14.1**.
🔗 **Hash**: `25bc02fac74051ddae15ce79e952f00211b1ea6b`.
Q9What if no patch? (Workaround)
🛡️ **Temporary Mitigation**: If an immediate upgrade is not possible, it is recommended to implement strict **whitelist filtering** or **length/complexity restrictions** on the `regex` parameter to intercept suspicious r…
⚡ **Priority**: **High**.
📅 **Time**: Exploit is public, and the CVSS score includes an availability impact. It is recommended to upgrade to v2.14.1 **as soon as possible** to eliminate the risk.