Critical Regular Expression Denial of Service Vulnerability in node-ua-parser-js Package
Summary
UBUNTU-CVE-2020-7733: The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. Affects node-ua-parser-js versions 0.7.14-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-ua-parser-js package is a JavaScript library used for parsing user agent strings, allowing developers to identify the device, operating system, and browser of users. This package is widely utilized in web applications to enhance user experience and analytics. However, versions prior to 0.7.22 are susceptible to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact application performance and availability.
Vulnerability Detail
The vulnerability arises from the regex patterns used to parse user agent strings for specific devices, such as Redmi Phones and Mi Pad Tablets. Attackers can exploit this vulnerability by crafting malicious user agent strings that trigger excessive backtracking in the regex engine, leading to significant delays and potential denial of service. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize user agent strings before processing them with the node-ua-parser-js library. This can help mitigate the risk of exploitation.
Conclusion
The node-ua-parser-js package has a critical vulnerability that can lead to denial of service attacks through regex exploitation. It is crucial to update to the patched version to ensure the security and reliability of your applications. Utilizing tools like Vulert can aid in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for node-ua-parser-js →
FAQ
ReDoS is a type of denial of service attack that exploits the performance characteristics of regular expressions, causing applications to hang or crash when processing specially crafted input.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. By uploading your manifest file like package-lock.json to the Vulert playground, you can check if your application is affected.
Failure to address this vulnerability can lead to application downtime, degraded performance, and potential exploitation by malicious actors, impacting user experience and trust.
Yes, you should upgrade to version 0.7.22 or later of the node-ua-parser-js package to mitigate this vulnerability.
While you can technically continue using older versions, it is highly discouraged due to the security risks associated with the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-ua-parser-js.
