GHSA-6w63-h3fj-q4vw

Suggest an improvement
Source
https://github.com/advisories/GHSA-6w63-h3fj-q4vw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6w63-h3fj-q4vw/GHSA-6w63-h3fj-q4vw.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-6w63-h3fj-q4vw
Aliases
Related
Published
2023-06-06T17:33:13Z
Modified
2024-01-25T21:05:07Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
fast-xml-parser vulnerable to Regex Injection via Doctype Entities
Details

Impact

"fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time.

Patches

The problem has been resolved in v4.2.4

Workarounds

Avoid using DOCTYPE parsing by processEntities: false option.

Database specific 
{
    "nvd_published_at": "2023-06-06T18:15:11Z",
    "cwe_ids": [
        "CWE-1333"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-06T17:33:13Z"
}
References

Affected packages

npm / fast-xml-parser

Package

Name
fast-xml-parser
View open source insights on deps.dev
Purl
pkg:npm/fast-xml-parser

Affected ranges

Type
SEMVER
Events
Introduced
4.1.3
Fixed
4.2.4

Ecosystem specific 

{
    "affected_functions": [
        "(fast-xml-parser).XMLParser"
    ]
}