CVE-2020-1911
📋 TL;DR
A type confusion vulnerability in Facebook's Hermes JavaScript engine allows attackers to potentially execute arbitrary code by crafting malicious JavaScript objects with specially-designed prototype chains. This affects applications using vulnerable versions of Hermes that permit evaluation of untrusted JavaScript. Most React Native applications are not affected because they typically don't evaluate untrusted JavaScript.
💻 Affected Systems
- Facebook Hermes
- React Native applications using Hermes
📦 What is this software?
Hermes by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash or denial of service; RCE only if application specifically evaluates untrusted JavaScript.
If Mitigated
No impact if application doesn't evaluate untrusted JavaScript or is properly patched.
🎯 Exploit Status
Exploitation requires the application to process untrusted JavaScript, which is not the default for most Hermes implementations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit fe52854cdf6725c2eaa9e125995da76e6ceb27da and later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2020-1911
Restart Required: Yes
Instructions:
1. Update Hermes to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da or later. 2. For React Native apps: Update to a version that includes the patched Hermes engine. 3. Rebuild and redeploy applications.
🔧 Temporary Workarounds
Disable JavaScript evaluation
allPrevent applications from evaluating untrusted JavaScript code
Network segmentation
allIsolate applications using Hermes from untrusted networks
🧯 If You Can't Patch
- Disable evaluation of any untrusted JavaScript in applications
- Implement strict input validation and sandboxing for JavaScript execution
🔍 How to Verify
Check if Vulnerable:
Check Hermes version/commit hash against vulnerable range. For React Native apps: check if using vulnerable Hermes version.Check Version:
Check application dependencies for Hermes version or commit hashVerify Fix Applied:
Verify Hermes is at commit fe52854cdf6725c2eaa9e125995da76e6ceb27da or later. Test that JavaScript evaluation functions properly without crashes.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Memory access violation errors
- Unusual JavaScript evaluation patterns
Network Indicators:
- Unexpected network connections from Hermes processes
- Suspicious JavaScript payloads in application traffic
SIEM Query:
Search for process crashes related to Hermes or JavaScript engine, or unexpected outbound connections from applications using Hermes