CVE-2020-27511
📋 TL;DR
CVE-2020-27511 is a Regular Expression Denial of Service (ReDoS) vulnerability in Prototype.js library versions 1.7.3 and earlier. Attackers can craft malicious HTML tags that cause excessive CPU consumption when processed by stripTags or unescapeHTML functions, potentially making applications unresponsive. This affects any web application using vulnerable versions of the Prototype.js library.
💻 Affected Systems
- Prototype JavaScript Framework
📦 What is this software?
Prototype by Prototypejs
⚠️ Risk & Real-World Impact
Worst Case
Complete application denial of service, making affected web services unavailable to legitimate users due to CPU exhaustion.
Likely Case
Degraded application performance and intermittent service disruptions when attackers submit crafted payloads.
If Mitigated
Minimal impact with proper input validation, rate limiting, and updated library versions.
🎯 Exploit Status
Proof of concept available on GitHub demonstrates ReDoS with crafted HTML tags.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.4 or later
Vendor Advisory: https://github.com/prototypejs/prototype
Restart Required: No
Instructions:
1. Update Prototype.js to version 1.7.4 or later. 2. Replace prototype.js file in your application. 3. Test application functionality.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation to reject or sanitize HTML tags before processing.
Rate Limiting
allImplement rate limiting on endpoints that process HTML input to prevent DoS attacks.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block malicious HTML patterns
- Disable or replace stripTags and unescapeHTML functions with safer alternatives
🔍 How to Verify
Check if Vulnerable:
Check if prototype.js version is 1.7.3 or earlier in your application's source code or dependencies.Check Version:
grep -r 'Prototype' package.json || find . -name '*.js' -exec grep -l 'prototype' {} \; | xargs grep -l 'version'Verify Fix Applied:
Verify prototype.js version is 1.7.4 or later and test stripTags/unescapeHTML functions with sample inputs.📡 Detection & Monitoring
Log Indicators:
- Unusually high CPU usage on web servers
- Increased request processing times for HTML input endpoints
Network Indicators:
- Multiple requests containing complex HTML patterns to vulnerable endpoints
SIEM Query:
source="web_server" AND (cpu_usage>90% OR response_time>5000ms) AND uri="*stripTags*" OR uri="*unescapeHTML*"🔗 References
- http://prototypejs.org/
- https://github.com/prototypejs/prototype/blob/dee2f7d8611248abce81287e1be4156011953c90/src/prototype/lang/string.js#L283
- https://github.com/yetingli/PoCs/blob/main/CVE-2020-27511/Prototype.md
- http://prototypejs.org/
- https://github.com/prototypejs/prototype/blob/dee2f7d8611248abce81287e1be4156011953c90/src/prototype/lang/string.js#L283
- https://github.com/yetingli/PoCs/blob/main/CVE-2020-27511/Prototype.md
