PT-2021-11556 · Unknown · Es6-Crawler-Detect

Eran Levin + 1 · Published 2021-03-22 · Updated 2021-04-13 · CVE-2020-28501

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: es6-crawler-detect versions prior to 3.1.3

Description: The issue arises from the lack of limitation on the length of user agent strings supplied to regex operators. This can lead to potential problems when processing user agent strings of excessive length.

Recommendations: For versions prior to 3.1.3, update to version 3.1.3 or later to resolve the issue. As a temporary workaround, consider implementing custom length checks on user agent strings before passing them to regex operators.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-28501

GHSA-JXG6-FHWC-9V9C

SNYK-JS-ES6CRAWLERDETECT-1051529

Affected Products

Es6-Crawler-Detect

References · 8

• 🔥 https://snyk.io/vuln/SNYK-JS-ES6CRAWLERDETECT-1051529 · Exploit
• https://github.com/JefferyHus/es6-crawler-detect/pull/27 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-28501 · Security Note
• https://osv.dev/vulnerability/GHSA-jxg6-fhwc-9v9c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28501 · Vendor Advisory
• https://t.me/cvenotify/11709 · Telegram Post
• https://t.me/cvenotify/12004 · Telegram Post
• https://t.me/cibsecurity/25219 · Telegram Post