CVE-2020-28500: Regular Expression Denial of Service (ReDoS) in lodash

Background

The lodash package is a popular utility library for JavaScript that provides helpful functions for manipulating and working with arrays, objects, and other data types. It is widely used in various applications and frameworks. However, versions of lodash prior to 4.17.21 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability affects the toNumber, trim, and trimEnd functions in lodash.

Vulnerability Detail

The Regular Expression Denial of Service (ReDoS) vulnerability in lodash allows an attacker to exploit the toNumber, trim, and trimEnd functions by providing specially crafted input strings. When these functions are called with a malicious input string, they can enter into an inefficient regular expression matching process that can cause the application to hang or crash. This can lead to denial of service attacks, where an attacker can repeatedly send malicious requests to exhaust server resources and disrupt the normal functioning of the application.

npm install lodash@4.18.1

npm install lodash@4.17.21

Workaround

If upgrading to the latest version of lodash is not immediately feasible, a possible workaround is to implement input validation and sanitization for the affected functions. By carefully validating and sanitizing user input before passing it to the toNumber, trim, and trimEnd functions, developers can reduce the risk of a successful ReDoS attack. Here is an example of how input validation can be implemented for the trim function in lodash:

var lo = require('lodash');

function safeTrim(str) {
  if (typeof str !== 'string') {
    throw new Error('Invalid input: expected a string');
  }

  // Perform the trim operation
  return lo.trim(str);
}

var input = '   Hello, World!   ';
var trimmed = safeTrim(input);
console.log(trimmed); // Output: 'Hello, World!'

By validating the input type and ensuring it is a string, the risk of a ReDoS attack can be mitigated.

Conclusion

The Regular Expression Denial of Service (ReDoS) vulnerability in lodash can be mitigated by upgrading to version 4.17.21 or later. Developers should also consider implementing input validation and sanitization for the affected functions as a temporary workaround. It is important to stay updated with the latest security patches and best practices to ensure the security and availability of the application. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for lodash →

FAQ