Regular Expression Denial of Service (ReDoS) Vulnerability in ua-parser-js Package
Summary
CVE-2022-25927: Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function. Affects node-ua-parser-js versions < a6140a17dd0300a35cfc9cff999545f267889411. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ua-parser-js package is a widely used library in JavaScript applications for parsing user agent strings. It provides functionality to extract browser, engine, OS, CPU, and device information from user agent strings. This package is crucial for developers who need to tailor their applications based on the user's environment. However, certain versions of this package are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can lead to performance degradation and potential service outages.
Vulnerability Detail
The vulnerability arises from the trim() function in versions of the ua-parser-js package prior to 0.7.33 and from 0.8.1 to before 1.0.33. This function is susceptible to ReDoS attacks, where an attacker can exploit the regular expressions used in the function to cause excessive backtracking. This can lead to significant delays in processing requests, effectively denying service to legitimate users. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to limit the user agent strings processed by the trim() function. This can help mitigate the risk of ReDoS attacks until a proper update can be applied.
Conclusion
The ua-parser-js package has a significant vulnerability that can lead to Denial of Service attacks through its trim() function. It is crucial for developers to update to the latest versions to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-ua-parser-js →
FAQ
A ReDoS attack exploits the way certain regular expressions are processed, causing excessive backtracking and leading to performance issues or service unavailability.
Versions of ua-parser-js from 0.7.30 and before 0.7.33, and from 0.8.1 and before 1.0.33 are vulnerable.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Implement input validation to limit the user agent strings processed by the vulnerable function as a temporary workaround.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-ua-parser-js.
