Is CVE-2019-20922 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-20922 being exploited in the wild.

How severe is CVE-2019-20922?

Low severity, with a CVSS score of 3.1, published 10 February 2022.

Which products and versions are affected?

handlebars (npm) SEMVER:introduced=4.0.0,fixed=4.4.5.

Is there a fix for CVE-2019-20922?

Yes. handlebars (npm): upgrade to 4.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-20922 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-20922?

Check whether you run handlebars (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-20922: Handlebars regular expression denial of service

CVE-2019-20922 · Severity: low · CVSS 3.1 · Published 2022-02-10

Handlebars is a popular templating engine used to dynamically generate HTML and other content in web applications. A flaw in its template parsing logic allows attackers to submit malicious templates that cause the parser to enter an infinite loop, consuming CPU resources and rendering the application unavailable to legitimate users. This vulnerability could be exploited remotely without authentication, making it a significant operational risk for services using vulnerable versions.

Technologies: handlebars (npm). Vendors: npm.

Quick answers

Is CVE-2019-20922 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-20922 being exploited in the wild.
How severe is CVE-2019-20922?: Low severity, with a CVSS score of 3.1, published 10 February 2022.
Which products and versions are affected?: handlebars (npm) SEMVER:introduced=4.0.0,fixed=4.4.5.
Is there a fix for CVE-2019-20922?: Yes. handlebars (npm): upgrade to 4.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-20922 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-20922?: Check whether you run handlebars (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

handlebars (npm): upgrade to 4.4.5 or later
```
npm install handlebars@4.4.5
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by eager matching in Handlebars' raw block content parsing logic (versions 4.0.0 through 4.4.4). The parser uses a greedy regular expression that, when processing crafted templates containing multiple raw blocks of the same kind, may experience catastrophic backtracking. An attacker can submit a specially-crafted template that forces the regex engine to perform exponential amounts of backtracking steps, consuming excessive CPU and causing availability issues. The vulnerability is remotely exploitable with no authentication or user interaction required beyond providing the malicious template to the vulnerable Handlebars instance. A fix was released in version 4.4.5, which changes the regex matching from eager to non-eager mode to prevent the excessive backtracking.

Affected products

Handlebars Handlebars >=4.0.0, <4.4.5

Identifiers

CVE-2019-20922
GHSA-62gr-4qp9-h98f

Timeline

2019-10-30: disclosed
2019: patched: Version 4.4.5 released with fix
2022-02-10: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.