Internet Bug Bounty · Report #2807139

CVE-2024-49761: ReDoS vulnerability in REXML

Validstatus

mediumseverity

33upvotes

30 Nov 2024disclosed

Summary

CVE-2024-49761: ReDoS vulnerability in REXML

There is a ReDoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-49761. We strongly recommend upgrading the REXML gem.

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

Details

When parsing an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;).

Please update REXML gem to version 3.3.9 or later.

Affected versions

REXML gem 3.3.8 or prior with Ruby 3.1 or prior

How it was found

Hi, When REXML is used to parse an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;) may lead to ReDos. Advisory: https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/

Impact

Reduced performance or Denial of Service was possible where REXML is used to parse user input.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original