Junglewise Threat Intelligence

CVE-2020-28500: lodash ReDoS in toNumber and trim functions

CVE-2020-28500 · Severity: low · CVSS 3.1 · Published 2022-01-06

Technologies: lodash-rails (RubyGems), lodash (npm), lodash-es (npm). Vendors: RubyGems, Lodash, npm.

Executive brief

Lodash, a widely used JavaScript utility library, is vulnerable to a denial-of-service flaw when processing specifically crafted large strings. An attacker can exploit this by providing long strings to certain text-processing functions, causing the application to consume excessive CPU resources and become unresponsive. This can lead to service outages or significant performance degradation for web applications using affected versions of the library.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in lodash versions 4.0.0 through 4.17.20. The vulnerability is rooted in the use of inefficient regular expressions (specifically those handling whitespace trimming like /\s+$/) within the `toNumber`, `trim`, and `trimEnd` functions. An attacker can trigger catastrophic backtracking by passing a large string (e.g., ~50KB) containing a specific pattern of characters and trailing whitespace. This results in high CPU utilization and thread blocking, leading to a denial of service. The issue is fixed in version 4.17.21 by optimizing the string processing logic to avoid vulnerable regex patterns.

Affected products

  • lodash lodash >= 4.0.0, < 4.17.21
  • lodash lodash-es >= 4.0.0, < 4.17.21
  • lodash lodash.trim <= 4.5.1
  • lodash lodash.trimend <= 4.5.1
  • lodash-rails lodash-rails >= 4.0.0, < 4.17.21

Timeline

  • 2021-01-26: other: Initial performance improvement PR submitted to lodash
  • 2021-02-15: advisory: NVD published CVE-2020-28500
  • 2021-02-20: patched: Fix merged into lodash 4.17 branch
  • 2022-01-06: disclosed: GitHub Advisory published

References

Related threats