Regular Expression Denial of Service in PrototypeJS - CVE-2020-27511
Summary
CVE-2020-27511: An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOS) through stripping crafted HTML tags. Affects prototypejs versions < 2a2fc85322b4715a9513c596e3131690125ab6e2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PrototypeJS is a JavaScript framework that extends the capabilities of JavaScript, providing developers with a rich set of tools for building web applications. It simplifies DOM manipulation, event handling, and AJAX interactions. However, the library has been found to have vulnerabilities that can be exploited, particularly in its stripTags and unescapeHTML components, which are responsible for processing HTML content.
Vulnerability Detail
CVE-2020-27511 is a vulnerability in PrototypeJS versions prior to 1.7.3-1 that allows an attacker to exploit the stripTags and unescapeHTML functions. By crafting specific HTML tags, an attacker can trigger a Regular Expression Denial of Service (ReDOS), leading to potential service disruptions. This vulnerability arises from the way the library processes regular expressions, making it susceptible to certain patterns that can cause excessive backtracking and resource exhaustion.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing input data to prevent the use of crafted HTML tags that could exploit this vulnerability. Implementing a robust input validation mechanism can help mitigate the risk until the package is updated.
Conclusion
CVE-2020-27511 is a significant vulnerability in the PrototypeJS library that can lead to Denial of Service attacks. It is crucial for developers using this library to update to the latest version to safeguard their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for prototypejs →
FAQ
CVE-2020-27511 is a vulnerability in the PrototypeJS library that allows for Regular Expression Denial of Service (ReDOS) attacks through the stripTags and unescapeHTML functions.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The primary impact is service disruption due to Denial of Service, which can lead to unavailability of the application for users.
Yes, implementing input validation and sanitization can help mitigate the risk until an upgrade can be performed.
The CVSS score for CVE-2020-27511 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for prototypejs.
