CVE-2022-39353: Multiple Root Nodes in xmldom Package
Summary
CVE-2022-39353: xmldom allows multiple root nodes in a DOM. Affects xmldom versions < 0.6.0. No fix is published. How to fix ↓
Also tracked for
- node-xmldom · Debian:11
The same CVE-2022-39353 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xmldom package is an XML parser for Node.js that allows developers to manipulate XML documents using the Document Object Model (DOM) API. It provides functionality for parsing, modifying, and generating XML documents. However, a vulnerability has been discovered in versions prior to 0.7.7, 0.8.4, and 0.9.0-beta.4, which allows multiple root nodes in a DOM, violating the assumption of a single root node in the tree.
Vulnerability Detail
The vulnerability in xmldom arises from its ability to parse XML that is not well-formed and contains multiple top-level elements. Instead of reporting an error or throwing an exception, xmldom adds all root nodes to the childNodes collection of the Document. This behavior breaks the assumption of a single root node and can lead to various issues, including potential security vulnerabilities. The vulnerability has been assigned the CVE identifier CVE-2022-39353 and has a CVSS score of 9.8 (Critical). More details can be found in the NVD entry: CVE-2022-39299.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not feasible, there are a couple of workarounds that can be implemented. One approach is to modify the code to only search for elements within the documentElement instead of the entire DOM. Another workaround is to reject any document that has more than one childNode. Implementing these workarounds can help mitigate the risk of the vulnerability.
Conclusion
In conclusion, the xmldom package prior to versions 0.7.7, 0.8.4, and 0.9.0-beta.4 is vulnerable to a critical security issue (CVE-2022-39353) that allows multiple root nodes in a DOM. To mitigate the risk, it is recommended to update the package to the latest version or apply the provided workarounds. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xmldom →
FAQ
xmldom is an XML parser for Node.js that provides a DOM API for manipulating XML documents.
The vulnerability allows multiple root nodes in a DOM, which can lead to various issues and potential security vulnerabilities.
To fix the vulnerability, update the xmldom package to version 0.7.7, 0.8.4, or 0.9.0-beta.4.
Yes, you can either modify the code to search within the documentElement or reject documents with more than one childNode.
You can refer to the NVD entry for CVE-2022-39299 and the GitHub issue https://github.com/jindw/xmldom/issues/150 for more details.
References
Related vulnerabilities
Recent vulnerabilities recorded for xmldom.
