CVE-2024-34391: libxmljs - Type Confusion Vulnerability
Summary
CVE-2024-34391: libxmljs vulnerable to type confusion when parsing specially crafted XML. Affects libxmljs versions < 1.0.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxmljs is an npm package that provides a JavaScript interface to the libxml2 library, allowing users to parse and manipulate XML documents. It is commonly used in Node.js applications for XML processing tasks. However, libxmljs versions 0 through 1.0.11 are vulnerable to a type confusion vulnerability when parsing specially crafted XML. This vulnerability can lead to various consequences, including denial of service, data leak, infinite loop, and even remote code execution on 32-bit systems with the XML_PARSE_HUGE flag enabled.
Vulnerability Detail
The vulnerability in libxmljs arises when a function is invoked on the result of attrs() that was called on a parsed node. This triggers a type confusion issue, which can be exploited by an attacker to manipulate the program's behavior. On both 32-bit and 64-bit systems, this vulnerability can result in denial of service. Additionally, on 32-bit systems with the XML_PARSE_HUGE flag enabled, it can lead to remote code execution. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid calling the attrs() function on parsed nodes until the package is updated. This can be achieved by modifying the code to skip or replace the attrs() function call with an alternative approach for accessing attributes in the XML document.
Conclusion
The libxmljs package is vulnerable to a type confusion vulnerability that can have severe consequences, including denial of service and remote code execution. It is crucial to update to a secure version of libxmljs (1.0.12 or later) to mitigate this vulnerability. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libxmljs →
FAQ
libxmljs is an npm package that provides a JavaScript interface to the libxml2 library, enabling XML parsing and manipulation in Node.js applications.
Versions 0 through 1.0.11 of libxmljs are affected by this vulnerability.
This vulnerability can result in denial of service, data leak, infinite loop, and remote code execution on 32-bit systems with the XML_PARSE_HUGE flag enabled.
To fix this vulnerability, upgrade libxmljs to a version beyond 1.0.11 by updating the package.json file and running npm install.
Yes, as a temporary workaround, avoid calling the attrs() function on parsed nodes until the package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for libxmljs.
