CVE-2020-1920: 
JavaScript vulnerability analysis and mitigation

A regular expression denial of service (ReDoS) vulnerability was discovered in the validateBaseUrl function of react-native. The vulnerability was introduced in version 0.59.0 and fixed in version 0.64.1. The issue was assigned CVE-2020-1920 and was reported through Facebook's Whitehat program (GitHub Security Lab, NVD).

The vulnerability exists in the validateBaseUrl function which uses a regex pattern based on a MIT-licensed gist for URL validation. The regular expression was vulnerable to exponential backtracking, leading to potential denial of service. The issue received a CVSS v3.1 Base Score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability could cause the application to use excessive resources, become unresponsive, or crash. The issue affects systems where the validateBaseUrl function is used with user-provided input (GitHub Security Lab).

The vulnerability can be triggered by providing specially crafted input to the validateBaseUrl function. A proof of concept demonstrates that malicious URLs can cause the regular expression engine to enter an exponential backtracking state (GitHub Security Lab).

The vulnerability was fixed in react-native version 0.64.1 by updating the validateBaseUrl function to use a more robust regular expression pattern. Users should upgrade to version 0.64.1 or later to receive the security fix (React Native Release).