ReDoS Vulnerability in HAPI FHIR Validator FHIRPath Endpoint

Vulnerability Overview Vulnerability Name: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint Vulnerability Type: Denial of Service (ReDoS) Severity: High (7.5 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Affected Scope Affected Packages: - (Maven) - (Maven) - (Maven) - (Maven) - (Maven) - (Maven) - (Maven) - (Maven) Affected Versions: <= 6.9.8 Fixed Versions: 6.9.9, 6.9.4.2 Remediation Fixed Versions: 6.9.9, 6.9.4.2 Detailed Information Description: - All FHIRPathEngine implementations accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility class intended to protect this evaluation failed to execute correctly and did not fully cover all locations where the evaluation is performed during the process. An attacker can send requests containing malicious regular expressions, causing catastrophic backtracking, exhausting system resources, and leading to a denial of service. Details: - The vulnerability exists in the regular expression execution within the FHIRPathEngine implementation, involving multiple code modules. The FHIRPath functions , , and pass user-controlled regular expressions to Java's and through a utility class designed to time out after a specified duration. While this utility correctly cancels individual execution threads and throws an exception, the execution within those threads does not listen for this cancellation, causing the execution to persist. Additionally, three modules contain calls to methods in the FHIRPathEngine that are not protected by this utility class. Why it is exploitable: - Java's with a pattern like against the input causes exponential backtracking (O(2^n) time complexity). Impact: - CPU Exhaustion: Exponential backtracking in the Java regular expression engine consumes 100% of CPU cores. The duration depends on the length of the input string (for sufficiently long input strings, this is effectively infinite). POC Code

Goal Reached Thanks to every supporter — we hit 100%!

ReDoS Vulnerability in HAPI FHIR Validator FHIRPath Endpoint

More from this source