Executive Summary

This vulnerability exists in the Underscore.js library prior to version 1.13.8, specifically in the _.flatten and _.isEqual functions. These functions use recursion without a depth limit, which under very specific conditions can be exploited by an attacker to cause a stack overflow, leading to a Denial of Service (DoS) attack.

To exploit this, an attacker must supply untrusted input that creates a deeply recursive data structure, for example by using JSON.parse without enforcing a depth limit. This data structure is then passed to _.flatten or _.isEqual.

For _.flatten, exploitation requires that the data structure consists only of arrays at all levels and that no finite depth limit is provided as the second argument. For _.isEqual, exploitation requires a scenario where two distinct but equivalent data structures submitted by the same remote client are compared.

If a stack overflow occurs during these function calls, exceptions are not caught, which can crash the application or cause it to become unresponsive.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a Denial of Service (DoS) attack against applications using vulnerable versions of Underscore.js. An attacker can cause the application to crash or become unresponsive by triggering a stack overflow through specially crafted recursive data structures.

Such an attack can disrupt service availability, potentially affecting users and business operations that rely on the affected application.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the Underscore.js library to version 1.13.8 or later, where the issue is fixed.

Additionally, avoid passing untrusted input that creates deeply recursive data structures to the _.flatten or _.isEqual functions without enforcing a finite depth limit.

Useful 0 Not Useful 0