CVE-2020-28500: lodash ReDoS in toNumber and trim functions

CVE-2020-28500 · Severity: low · CVSS 3.1 · Published 2022-01-06

Lodash, a widely used JavaScript utility library, is vulnerable to a denial-of-service flaw when processing specifically crafted large strings. An attacker can exploit this by providing long strings to certain text-processing functions, causing the application to consume excessive CPU resources and become unresponsive. This can lead to service outages or significant performance degradation for web applications using affected versions of the library.

Technologies: lodash (npm), lodash-es (npm), lodash-rails (RubyGems). Vendors: npm, RubyGems.

Quick answers

Is CVE-2020-28500 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-28500 being exploited in the wild.
How severe is CVE-2020-28500?
Low severity, with a CVSS score of 3.1, published 6 January 2022.
Which products and versions are affected?
lodash (npm) SEMVER:introduced=4.0.0,fixed=4.17.21; lodash-es (npm) SEMVER:introduced=4.0.0,fixed=4.17.21; lodash.trim (npm) SEMVER:introduced=4.0.0,last_affected=4.5.1; lodash.trimend (npm) SEMVER:introduced=4.0.0,last_affected=4.5.1; and 1 more.
Is there a fix for CVE-2020-28500?
Yes. lodash (npm): upgrade to 4.17.21 or later; lodash-es (npm): upgrade to 4.17.21 or later; lodash-rails (RubyGems): upgrade to 4.17.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-28500 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-28500?
Check whether you run lodash (npm), lodash-es (npm), lodash.trim (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lodash (npm): upgrade to 4.17.21 or later
    npm install lodash@4.17.21
  • lodash-es (npm): upgrade to 4.17.21 or later
    npm install lodash-es@4.17.21
  • lodash-rails (RubyGems): upgrade to 4.17.21 or later
    bundle update lodash-rails

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in lodash versions 4.0.0 through 4.17.20. The vulnerability is rooted in the use of inefficient regular expressions (specifically those handling whitespace trimming like /\s+$/) within the `toNumber`, `trim`, and `trimEnd` functions. An attacker can trigger catastrophic backtracking by passing a large string (e.g., ~50KB) containing a specific pattern of characters and trailing whitespace. This results in high CPU utilization and thread blocking, leading to a denial of service. The issue is fixed in version 4.17.21 by optimizing the string processing logic to avoid vulnerable regex patterns.

Affected products

  • lodash lodash >= 4.0.0, < 4.17.21
  • lodash lodash-es >= 4.0.0, < 4.17.21
  • lodash lodash.trim <= 4.5.1
  • lodash lodash.trimend <= 4.5.1
  • lodash-rails lodash-rails >= 4.0.0, < 4.17.21

Identifiers

  • CVE-2020-28500
  • GHSA-29mw-wpgm-hmr9

Timeline

  • 2021-01-26: other: Initial performance improvement PR submitted to lodash
  • 2021-02-15: advisory: NVD published CVE-2020-28500
  • 2021-02-20: patched: Fix merged into lodash 4.17 branch
  • 2022-01-06: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.