CVE-2020-1912
📋 TL;DR
CVE-2020-1912 is an out-of-bounds read/write vulnerability in Facebook's Hermes JavaScript engine that could allow attackers to execute arbitrary code via crafted JavaScript. Only applications using Hermes that evaluate untrusted JavaScript are affected, meaning most React Native applications are not vulnerable.
💻 Affected Systems
- Facebook Hermes JavaScript engine
- React Native applications using Hermes
📦 What is this software?
Hermes by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash or denial of service; code execution is possible but requires specific conditions.
If Mitigated
No impact if application doesn't evaluate untrusted JavaScript or uses patched Hermes version.
🎯 Exploit Status
Exploitation requires crafting specific JavaScript to trigger the out-of-bounds condition in lazily compiled inner generator functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Hermes commit 091835377369c8fd5917d9b87acffa721ad2a168 or later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2020-1912
Restart Required: Yes
Instructions:
1. Update Hermes to commit 091835377369c8fd5917d9b87acffa721ad2a168 or later. 2. Rebuild and redeploy React Native applications using the updated Hermes engine. 3. Restart affected applications.
🔧 Temporary Workarounds
Disable untrusted JavaScript evaluation
allPrevent evaluation of untrusted JavaScript in Hermes engine
Configure application to not use eval(), Function constructor, or similar with untrusted input
🧯 If You Can't Patch
- Disable JavaScript evaluation of any untrusted content in applications
- Implement strict input validation and sanitization for any JavaScript execution
🔍 How to Verify
Check if Vulnerable:
Check Hermes version/commit hash in application. If using commit prior to 091835377369c8fd5917d9b87acffa721ad2a168, it's vulnerable.Check Version:
Check application's Hermes version through build configuration or runtime inspection if available.Verify Fix Applied:
Verify Hermes commit is 091835377369c8fd5917d9b87acffa721ad2a168 or later in application build.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected JavaScript evaluation errors
Network Indicators:
- Unusual JavaScript payloads being sent to application endpoints
SIEM Query:
Search for application logs containing 'Hermes', 'JavaScript engine crash', or memory violation errors