Executive brief
React Native is a framework used to develop mobile applications for iOS and Android using JavaScript. A flaw in the validateBaseUrl function allows attackers to craft malicious input that triggers a regular expression engine to consume excessive CPU resources, causing the application to become unresponsive or crash. This affects deployments using vulnerable versions of the library.
Technical details
A regular expression denial of service (ReDoS) vulnerability exists in the validateBaseUrl function in React Native's Blob URL handling. The vulnerability was introduced in version 0.59.0 and affects versions 0.59.0–0.62.2 and 0.63.0–0.64.0. The flaw stems from a poorly designed regular expression pattern that exhibits catastrophic backtracking when presented with certain malformed input strings. An attacker can supply a specially crafted URL to trigger excessive regex engine processing without authentication or special privileges. The fix involves replacing the vulnerable regex with a more efficient pattern, applied in versions 0.62.3 and 0.64.1 onwards.
Affected products
- Meta React Native 0.59.0–0.62.2, 0.63.0–0.64.0
Timeline
- 2021-07-20: disclosed
- 2021-06-01: patched: Fix available in versions 0.62.3 and 0.64.1