PT-2020-19779 · Express · Express-Validators

Yeting Li · Published 2020-11-11 · Updated 2021-07-21 · CVE-2020-7767

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions express-validators versions all

Description The issue concerns a Regular Expression Denial of Service (ReDoS) that occurs when validating specifically-crafted invalid URLs. This can happen in all versions of the express-validators package.

Recommendations For express-validators versions all, consider disabling the URL validation function until a patch is available to prevent potential ReDoS attacks. Restrict access to the validation module to minimize the risk of exploitation. Avoid using the express-validators package for URL validation until the issue is resolved.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-7767

GHSA-CF2X-RQC8-GRFQ

Affected Products

Express-Validators

References · 4

• 🔥 https://snyk.io/vuln/SNYK-JS-EXPRESSVALIDATORS-1017404 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7767 · Security Note
• https://osv.dev/vulnerability/GHSA-cf2x-rqc8-grfq · Vendor Advisory
• https://t.me/cvenotify/5536 · Telegram Post