Is CVE-2022-25927 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-25927 being exploited in the wild.

How severe is CVE-2022-25927?

Low severity, with a CVSS score of 3.1, published 24 January 2023.

Which products and versions are affected?

ua-parser-js (npm) SEMVER:introduced=0.7.30,fixed=0.7.33.

Is there a fix for CVE-2022-25927?

Yes. ua-parser-js (npm): upgrade to 0.7.33 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-25927 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-25927?

Check whether you run ua-parser-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-25927: ua-parser-js regular expression denial of service

CVE-2022-25927 · Severity: low · CVSS 3.1 · Published 2023-01-24

ua-parser-js is a JavaScript library that parses user-agent strings to identify browsers and devices. A regular expression flaw allows attackers to craft specially-patterned, extremely long user-agent strings that cause the parser to hang indefinitely, effectively disabling any application that relies on it for parsing user-agent data. This can result in application unavailability and degraded user experience.

Technologies: ua-parser-js (npm). Vendors: npm.

Quick answers

Is CVE-2022-25927 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-25927 being exploited in the wild.
How severe is CVE-2022-25927?: Low severity, with a CVSS score of 3.1, published 24 January 2023.
Which products and versions are affected?: ua-parser-js (npm) SEMVER:introduced=0.7.30,fixed=0.7.33.
Is there a fix for CVE-2022-25927?: Yes. ua-parser-js (npm): upgrade to 0.7.33 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-25927 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-25927?: Check whether you run ua-parser-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ua-parser-js (npm): upgrade to 0.7.33 or later
```
npm install ua-parser-js@0.7.33
```

Technical details

A regular expression denial of service (ReDoS) vulnerability exists in ua-parser-js versions 0.7.30–0.7.32 and 0.8.0–1.0.32. The vulnerability bypasses the library's MAX_LENGTH input validation due to an inefficient regular expression (CWE-1333) that exhibits exponential worst-case complexity. An attacker can send a specially crafted user-agent string with a specific pattern that triggers catastrophic backtracking in the regex engine, consuming excessive CPU and causing the application to hang. The attack vector is network-based with no authentication or user interaction required. Patches are available in versions 0.7.33 and 1.0.33, which remove the vulnerable regular expression.

Affected products

faisalman ua-parser-js 0.7.30 to before 0.7.33, 0.8.0 to before 1.0.33

Identifiers

CVE-2022-25927
GHSA-fhg7-m89q-25r3

Timeline

2023-01-24: disclosed
2023-01-24: patched: Patches released for versions 0.7.33 and 1.0.33

References

https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-fhg7-m89q-25r3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.