CVE-2023-23556
📋 TL;DR
A memory corruption vulnerability in Hermes JavaScript engine allows arbitrary code execution when converting BigInt to Number values. This affects React Native applications using vulnerable Hermes versions to execute untrusted JavaScript. Most React Native apps are unaffected since they typically don't execute untrusted code.
💻 Affected Systems
- Hermes JavaScript engine
- React Native applications using Hermes
📦 What is this software?
Hermes by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash or denial of service; RCE only in targeted attacks against apps executing untrusted JavaScript.
If Mitigated
No impact if Hermes isn't used or only trusted JavaScript is executed.
🎯 Exploit Status
Exploitation requires ability to inject untrusted JavaScript into Hermes runtime.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Hermes commit a6dcafe6ded8e61658b40f5699878cd19a481f80 and later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2023-23556
Restart Required: Yes
Instructions:
1. Update Hermes to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 or later. 2. For React Native apps: update Hermes dependency and rebuild application. 3. Redeploy updated applications.
🔧 Temporary Workarounds
Disable untrusted JavaScript execution
allPrevent execution of untrusted JavaScript in Hermes runtime
Use JavaScriptCore instead of Hermes
allSwitch React Native JavaScript engine to JavaScriptCore (iOS) or V8 (Android)
🧯 If You Can't Patch
- Isolate applications using vulnerable Hermes versions in network segments
- Implement strict input validation to prevent untrusted JavaScript injection
🔍 How to Verify
Check if Vulnerable:
Check Hermes version/commit hash in your application. If using React Native, check hermes-engine dependency version.Check Version:
For React Native: npx react-native info | grep Hermes. For direct Hermes: hermes --versionVerify Fix Applied:
Verify Hermes commit is a6dcafe6ded8e61658b40f5699878cd19a481f80 or later. For React Native apps, verify rebuilt application uses patched Hermes.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected Hermes process termination
- Unusual JavaScript execution patterns
Network Indicators:
- Unexpected outbound connections from React Native applications
- Suspicious JavaScript payloads in application traffic
SIEM Query:
Process:hermes AND (EventID:1000 OR ExceptionCode:c0000005)