Executive brief
lodash is a popular JavaScript utility library used across countless web applications and services. A flaw in the date parsing component allows an attacker to provide specially crafted long strings that cause excessive CPU consumption, potentially making the application unresponsive or unavailable to legitimate users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) vulnerability in the date handler component of lodash prior to version 4.17.11. The vulnerable code uses a regular expression that exhibits catastrophic backtracking when matching very long input strings, allowing an attacker to trigger uncontrolled resource consumption and cause a denial of service. The attack requires network access to submit long strings to the application, with no authentication or special privileges required. The attack vector is network-based, and exploitation causes the application to hang or crash. The fix is available in lodash version 4.17.11 and later.
Affected products
- lodash lodash prior to 4.17.11
- lodash lodash-es prior to 4.17.11
- lodash lodash-amd prior to 4.17.11
- lodash lodash-rails prior to 4.17.11
Timeline
- 2019-07-19: disclosed
- 2019-07-19: patched: Fixed in version 4.17.11