CVE-2020-1914
📋 TL;DR
A logic vulnerability in Facebook Hermes JavaScript engine allows attackers to potentially read out of bounds or execute arbitrary code via crafted JavaScript. This affects applications using Hermes that evaluate untrusted JavaScript. Most React Native applications are not affected since they typically don't evaluate untrusted code.
💻 Affected Systems
- Facebook Hermes JavaScript engine
📦 What is this software?
Hermes by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise
Likely Case
Memory corruption leading to application crash or information disclosure
If Mitigated
No impact if application doesn't evaluate untrusted JavaScript
🎯 Exploit Status
Requires ability to inject and execute JavaScript in vulnerable Hermes instance
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit b2021df620824627f5a8c96615edbd1eb7fdddfc or later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2020-1914
Restart Required: Yes
Instructions:
1. Update Hermes to commit b2021df620824627f5a8c96615edbd1eb7fdddfc or later
2. Rebuild any applications using Hermes
3. Redeploy updated applications
4. Restart affected services
🔧 Temporary Workarounds
Disable untrusted JavaScript evaluation
allPrevent evaluation of untrusted JavaScript in Hermes engine
🧯 If You Can't Patch
- Implement strict input validation for JavaScript code
- Sandbox Hermes execution environment with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check Hermes version/commit hash against vulnerable rangeCheck Version:
Check application dependencies or build configuration for Hermes versionVerify Fix Applied:
Verify Hermes is at commit b2021df620824627f5a8c96615edbd1eb7fdddfc or later📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violation errors
- Unexpected JavaScript execution
Network Indicators:
- Unusual JavaScript payloads being sent to application
SIEM Query:
Search for application crashes or memory violation events related to Hermes/JavaScript engine