CVE-2022-24373 Regular Expression Denial of Service (ReDoS)
Attackers can cause denial of service in applications using react-native-reanimated via malicious input triggering ReDoS in the color parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24373?
CVE-2022-24373 is a medium-severity denial of service vulnerability in react-native-reanimated, published on 30 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.
Weakness: CWE-1333
Which versions are affected by CVE-2022-24373?
2 open source packages ship an affected version, including react-native-reanimated. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
react-native-reanimated npm | All versions | 2.10.0 |
react-native-reanimated npm | All versions | 2.10.0 |
Products include Swmansion React Native Reanimated.
How do I fix CVE-2022-24373?
Upgrade react-native-reanimated to 2.10.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-24373 being exploited?
There is no known exploitation of CVE-2022-24373 in the wild and no public exploit code.
Sources
Also known as GHSA-2j79-8pqc-r7x6.