Internet Bug Bounty · Report #2645836

[CVE-2024-35176] DoS vulnerability in REXML

Validstatus

mediumseverity

$2,142bounty

19upvotes

23 Aug 2024disclosed

Summary

CVE-2024-35176: DoS vulnerability in REXML

There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-35176. We strongly recommend upgrading the REXML gem.

Details When parsing an XML document that has many < in an attribute value, REXML gem may take long time.

Please update REXML gem to version 3.2.7 or later.

Affected versions REXML gem 3.2.6 or prior

Credits Thanks to mprogrammer for discovering this issue.

Full Security Advisory: https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/

How it was found

I sent my original report here: https://hackerone.com/reports/2490560 REXML had a vulnerability where repeated > characters in an attribute value took a very long time for the parser to finish. The wait times increased exponentially the larger the string.

Impact

Reduced performance or Denial of Service was possible where REXML is used to parse user input. Rails uses REXML to convert XML to a hash, so this was susceptible:

Hash.from_xml(request.body.read)

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original