Is CVE-2020-7793 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-7793 being exploited in the wild.

How severe is CVE-2020-7793?

Low severity, with a CVSS score of 3.1, published 9 February 2022.

Which products and versions are affected?

ua-parser-js (npm) SEMVER:introduced=0,fixed=0.7.23.

Is there a fix for CVE-2020-7793?

Yes. ua-parser-js (npm): upgrade to 0.7.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-7793 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-7793?

Check whether you run ua-parser-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-7793: ua-parser-js Regular Expression Denial of Service

CVE-2020-7793 · Severity: low · CVSS 3.1 · Published 2022-02-09

ua-parser-js is a popular JavaScript library used to identify browser, engine, OS, and device details from user-agent strings. A vulnerability in how it processes these strings allows an attacker to send a specially crafted request that causes the system to consume excessive CPU resources. This can lead to a service slowdown or a complete crash, preventing legitimate users from accessing the application.

Technologies: ua-parser-js (npm). Vendors: npm.

Quick answers

Is CVE-2020-7793 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-7793 being exploited in the wild.
How severe is CVE-2020-7793?: Low severity, with a CVSS score of 3.1, published 9 February 2022.
Which products and versions are affected?: ua-parser-js (npm) SEMVER:introduced=0,fixed=0.7.23.
Is there a fix for CVE-2020-7793?: Yes. ua-parser-js (npm): upgrade to 0.7.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-7793 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-7793?: Check whether you run ua-parser-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ua-parser-js (npm): upgrade to 0.7.23 or later
```
npm install ua-parser-js@0.7.23
```

Technical details

The ua-parser-js library before version 0.7.23 contains multiple regular expressions susceptible to catastrophic backtracking. An attacker can exploit this by providing a malicious User-Agent string (e.g., containing long sequences of specific characters) that triggers exponential processing time in the regex engine. This is a Regular Expression Denial of Service (ReDoS) vulnerability (CWE-400). The attack can be executed remotely without authentication or user interaction. Successful exploitation results in high CPU exhaustion, leading to a Denial of Service (DoS) condition. The issue is fixed in version 0.7.23 by optimizing the affected regex patterns.

Affected products

faisalman ua-parser-js < 0.7.23

Identifiers

CVE-2020-7793
GHSA-394c-5j6w-4xmx

Timeline

2020-10-29: disclosed: Vulnerability disclosed to maintainer
2020-12-01: patched: Fix committed to repository
2020-12-11: advisory: NVD published CVE-2020-7793

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.