Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tcGc0LXJjOTItdng4ds4AA-Mb

fast-xml-parser vulnerable to ReDOS at currency parsing

Summary

A ReDOS that exists on currency.js was discovered by Gauss Security Labs R&D team.

Details

https://github.com/NaturalIntelligence/fast-xml-parser/blob/v4.4.0/src/v5/valueParsers/currency.js#L10 contains a vulnerable regex

PoC

pass the following string '\t'.repeat(13337) + '.'

Impact

Denial of service during currency parsing in experimental version 5 of fast-xml-parser-library

https://gauss-security.com

Permalink: https://github.com/advisories/GHSA-mpg4-rc92-vx8v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcGc0LXJjOTItdng4ds4AA-Mb
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 4 months ago
Updated: about 1 month ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-mpg4-rc92-vx8v, CVE-2024-41818
References:

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-mpg4-rc92-vx8v
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/d0bfe8a3a2813a185f39591bbef222212d856164
• https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/src/v5/valueParsers/currency.js#L10
• https://nvd.nist.gov/vuln/detail/CVE-2024-41818
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/ba5f35e7680468acd7906eaabb2f69e28ed8b2aa
• https://github.com/advisories/GHSA-mpg4-rc92-vx8v

Repository: https://github.com/NaturalIntelligence/fast-xml-parser
Blast Radius: 39.0

Affected Packages