CVE-2020-1896
📋 TL;DR
CVE-2020-1896 is a stack overflow vulnerability in Facebook Hermes JavaScript engine's 'builtin apply' function that could allow remote code execution. Only applications that evaluate untrusted JavaScript are affected - most React Native apps don't fall into this category. The vulnerability has a critical CVSS score of 9.8 due to its potential impact.
💻 Affected Systems
- Facebook Hermes JavaScript engine
📦 What is this software?
Hermes by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with arbitrary code execution leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Application crash or denial of service; actual code execution requires specific conditions where untrusted JavaScript is evaluated.
If Mitigated
No impact if application doesn't evaluate untrusted JavaScript or has been patched.
🎯 Exploit Status
Exploitation requires the ability to inject and execute JavaScript in the vulnerable Hermes instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Hermes with commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 or later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2020-1896
Restart Required: Yes
Instructions:
1. Update Hermes to version containing commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 or later. 2. Update any applications using Hermes to use the patched version. 3. Restart affected applications/services.
🔧 Temporary Workarounds
Disable JavaScript evaluation
allPrevent evaluation of untrusted JavaScript in applications using Hermes
🧯 If You Can't Patch
- Implement strict input validation and sanitization for any JavaScript input
- Isolate Hermes instances in containers or sandboxes to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check Hermes version/git commit hash against vulnerable commit rangeCheck Version:
Check application dependencies or build configuration for Hermes versionVerify Fix Applied:
Verify Hermes version includes commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 or later📡 Detection & Monitoring
Log Indicators:
- Application crashes with stack overflow errors
- Unusual JavaScript execution patterns
Network Indicators:
- Unexpected JavaScript payloads being sent to applications
SIEM Query:
Search for application crashes with Hermes-related stack traces or memory violation errors