Quick answers
- Is CVE-2020-7733 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-7733 being exploited in the wild.
- How severe is CVE-2020-7733?
- Low severity, with a CVSS score of 3.1, published 7 May 2021.
- Which products and versions are affected?
- ua-parser-js (npm) SEMVER:introduced=0,fixed=0.7.22.
- Is there a fix for CVE-2020-7733?
- Yes. ua-parser-js (npm): upgrade to 0.7.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-7733 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-7733?
- Check whether you run ua-parser-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- ua-parser-js (npm): upgrade to 0.7.22 or later
npm install ua-parser-js@0.7.22
Technical details
This vulnerability is a Regular Expression Denial of Service (ReDoS) in ua-parser-js versions prior to 0.7.22. The root cause is a poorly constructed regular expression used to parse Redmi phones and Mi Pad tablets in user-agent strings, which exhibits catastrophic backtracking when processing certain input patterns. The vulnerability is network-accessible and requires no authentication or user interaction; an attacker can send malicious user-agent headers to trigger excessive regex evaluation. Successful exploitation causes denial of service by exhausting CPU resources. The fix was released in version 0.7.22 and is documented in commit 233d3ba.
Affected products
- faisalman ua-parser-js before 0.7.22
Identifiers
- CVE-2020-7733
- GHSA-662x-fhqg-9p8v
Timeline
- 2021-05-07: disclosed: Advisory published
- 2020: patched: Fix available in version 0.7.22