REDHAT-BUG-2484115: High severity React Router React Router vulnerability
React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.14.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2484115?
The severity of REDHAT-BUG-2484115 is classified as high with a score of 7.
What does REDHAT-BUG-2484115 describe?
REDHAT-BUG-2484115 describes a vulnerability in React Router that can allow unauthorized remote code execution under specific conditions.
How can I fix REDHAT-BUG-2484115?
To fix REDHAT-BUG-2484115, update React Router to a version beyond 7.14.1 that addresses this vulnerability.
Which versions of React Router are affected by REDHAT-BUG-2484115?
Versions 7.0.0 through 7.14.1 of React Router are affected by REDHAT-BUG-2484115.
What are the conditions required for the exploit in REDHAT-BUG-2484115 to be successful?
The exploit in REDHAT-BUG-2484115 requires an existing prototype pollution vulnerability in the application code alongside the use of Framework Mode.