CVE-2022-24373: React Native Reanimated ReDoS Vulnerability

CVE-2022-24373 Overview

CVE-2022-24373 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the react-native-reanimated package before version 3.0.0-rc.1. The vulnerability exists due to improper usage of regular expressions in the parser of Colors.js, allowing attackers to cause application hangs or crashes by providing specially crafted input that triggers catastrophic backtracking in the regex engine.

Critical Impact

Attackers can remotely trigger denial of service conditions in React Native applications using vulnerable versions of react-native-reanimated, potentially rendering mobile applications unresponsive.

Affected Products

• react-native-reanimated versions prior to 3.0.0-rc.1
• Applications built with vulnerable versions of the swmansion react_native_reanimated package
• React Native mobile applications utilizing the Colors.js parser functionality

Discovery Timeline

• 2022-09-30 - CVE-2022-24373 published to NVD
• 2025-05-20 - Last updated in NVD database

Technical Details for CVE-2022-24373

Vulnerability Analysis

This vulnerability falls under CWE-1333 (Inefficient Regular Expression Complexity), a category of algorithmic complexity attacks that specifically targets regular expression implementations. The Colors.js parser in react-native-reanimated contains a regular expression pattern that exhibits exponential time complexity when processing certain input strings.

When a malicious input is provided to the color parsing functionality, the regex engine enters a state of catastrophic backtracking. This occurs because the pattern contains nested quantifiers or overlapping alternations that cause the engine to explore an exponentially growing number of possible matches before ultimately failing. During this process, the JavaScript runtime becomes blocked, causing the application to freeze or become completely unresponsive.

The vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. While the attack does not compromise data confidentiality or integrity, it can completely exhaust system resources and cause significant availability disruption.

Root Cause

The root cause of CVE-2022-24373 lies in the inefficient regular expression patterns used within the Colors.js file of the react-native-reanimated library. The vulnerable regex pattern was designed to parse color values but lacks safeguards against pathological input patterns. When confronted with specially crafted strings that nearly match the expected pattern but ultimately fail, the regex engine exhaustively explores all possible matching permutations, leading to exponential processing time.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to supply malicious color string input to the affected parsing function. This could occur through:

• User-supplied color values in application forms or configuration
• Data received from external APIs or services processed by the application
• Deep links or URL parameters containing color specifications
• Inter-process communication in React Native bridges

The vulnerability is exploitable without authentication or privileges, and no user interaction is required beyond the application processing the malicious input.

The vulnerability manifests in the color parsing regular expression within Colors.js. The fix implemented in pull request #3382 addresses the inefficient regex pattern by rewriting it to avoid catastrophic backtracking. For technical details on the specific code changes, refer to the commit details.

Detection Methods for CVE-2022-24373

Indicators of Compromise

• Unexplained application freezes or hangs during color value processing
• Elevated CPU usage in JavaScript threads without corresponding user activity
• Application Not Responding (ANR) errors in mobile applications with color parsing operations
• Timeout errors in components that accept color inputs

Detection Strategies

• Implement dependency scanning in CI/CD pipelines to identify react-native-reanimated versions prior to 3.0.0-rc.1
• Monitor application performance metrics for sudden CPU spikes correlated with color input processing
• Use Software Composition Analysis (SCA) tools to track vulnerable package versions across projects
• Deploy runtime protection that can detect and interrupt long-running regex operations

Monitoring Recommendations

• Configure alerting for JavaScript thread execution times exceeding normal thresholds
• Monitor application crash reports and ANR statistics for patterns indicating ReDoS attacks
• Implement logging around color parsing functions to correlate with performance anomalies
• Track package.json and yarn.lock files for vulnerable dependency versions

How to Mitigate CVE-2022-24373

Immediate Actions Required

• Upgrade react-native-reanimated to version 3.0.0-rc.1 or later immediately
• Audit all applications using react-native-reanimated and prioritize updates based on exposure risk
• Review application code for direct usage of the Colors.js parser with untrusted input
• Implement input validation to reject malformed color strings before they reach the parser

Patch Information

The vulnerability has been addressed in react-native-reanimated version 3.0.0-rc.1 and later. The fix is available through the official release. Organizations should update their package.json to require the patched version:

For detailed information about the vulnerability and fix, consult the Snyk Vulnerability Report.

Workarounds

• Implement input sanitization to validate and normalize color values before passing them to the reanimated library
• Add timeout wrappers around color parsing operations to prevent infinite processing
• Consider implementing server-side color validation to filter malicious inputs before they reach mobile clients
• Temporarily restrict color customization features until the upgrade can be completed

# Configuration example
# Update react-native-reanimated to patched version
npm install react-native-reanimated@^3.0.0-rc.1

# Or using yarn
yarn add react-native-reanimated@^3.0.0-rc.1

# Verify installed version
npm list react-native-reanimated