CVE-2021-24045
📋 TL;DR
A type confusion vulnerability in Facebook Hermes JavaScript engine prior to v0.10.0 could allow arbitrary code execution when processing untrusted JavaScript. Only applications that evaluate untrusted JavaScript code are affected, which excludes most React Native applications that don't execute user-provided code.
💻 Affected Systems
- Facebook Hermes JavaScript engine
- React Native applications using Hermes
📦 What is this software?
Hermes by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash or denial of service in React Native apps; code execution only in apps that evaluate untrusted JavaScript.
If Mitigated
No impact if application doesn't evaluate untrusted JavaScript or is properly patched.
🎯 Exploit Status
Exploitation requires the application to process malicious JavaScript, which is not the default behavior for most React Native apps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Hermes v0.10.0 and later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2021-24045
Restart Required: Yes
Instructions:
1. Update Hermes dependency to v0.10.0 or later in package.json. 2. Run npm/yarn install. 3. Rebuild and redeploy React Native application. 4. Restart application services.
🔧 Temporary Workarounds
Disable JavaScript evaluation
allPrevent evaluation of untrusted JavaScript in your application
🧯 If You Can't Patch
- Implement strict input validation and sanitization for any JavaScript evaluation
- Isolate the JavaScript evaluation in a sandboxed environment with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check package.json for Hermes version <0.10.0 or examine application dependenciesCheck Version:
npm list hermes-engine or check package.json for hermes-engine versionVerify Fix Applied:
Verify Hermes version is >=0.10.0 in package.json and node_modules/hermes-engine/package.json📡 Detection & Monitoring
Log Indicators:
- Application crashes with Hermes-related errors
- Unexpected JavaScript evaluation attempts
Network Indicators:
- Unusual outbound connections from React Native application
SIEM Query:
Search for process crashes containing 'hermes' or 'JavaScriptCore' in application logs