CVE-2020-28496: Denial of Service in three
Summary
CVE-2020-28496: Denial of service in three. Affects three versions < 0.125.0. Fixed in 0.125.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'three' package is an open-source JavaScript library used for creating and rendering 3D computer graphics in web applications. It provides a wide range of features and functionalities for working with 3D objects, materials, lights, and cameras. The package is commonly used in web development projects that require interactive and visually appealing 3D graphics. However, versions of 'three' before 0.125.0 are vulnerable to a denial of service (DoS) attack when handling rgb or hsl colors.
Vulnerability Detail
The vulnerability in the 'three' package allows an attacker to cause a DoS condition by exploiting the way rgb or hsl colors are handled. By providing a specially crafted input, an attacker can trigger excessive resource consumption, leading to a system crash or unresponsiveness. This vulnerability poses a significant risk to applications that utilize the 'three' package, as it can be exploited remotely without authentication. The issue has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
0.125.0
This is the first release that contains the fix.
npm install three@0.125.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the 'three' package is not immediately feasible, a temporary workaround can be implemented by validating and sanitizing user input before passing it to the vulnerable code. This can help mitigate the risk of exploitation. Here's an example of how to sanitize the input in JavaScript:
var three = require('three');
function sanitizeColorInput(color) {
// Validate and sanitize the color input
// ... (implementation specific to the application)
return color;
}
var Color = three.Color;
var sanitizedColor = sanitizeColorInput(userInput);
new Color(sanitizedColor);
Conclusion
The 'three' package before version 0.125.0 is vulnerable to a denial of service attack when handling rgb or hsl colors. It is crucial for developers to update their 'three' package to the latest version (0.125.0 or later) to mitigate the risk of exploitation. Additionally, implementing input validation and sanitization can provide temporary protection until the package is updated. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for three →
FAQ
This vulnerability can lead to a denial of service condition, causing the affected application to crash or become unresponsive. It can be exploited remotely without authentication.
Versions of 'three' before 0.125.0 are affected by this vulnerability.
Yes, updating the 'three' package to version 0.125.0 or later fixes this vulnerability.
A temporary workaround is to validate and sanitize user input before passing it to the vulnerable code.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-fq6p-x6j3-cmmq/GHSA-fq6p-x6j3-cmmq.json
References
Related vulnerabilities
Recent vulnerabilities recorded for three.
