Denial of Service Vulnerability in Woodstox XML Parser (CVE-2022-40152)
Summary
CVE-2022-40152: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. Affects libwoodstox-java across 2 version ranges.
< 3d168dc71fe5c7e22ab3cf7d7bfd7ae87dafc9c7
< f124f777fb8831430f930816a9e18813788c69cb
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Woodstox is an open-source XML processor written in Java, designed to provide high-performance parsing and streaming of XML data. It is widely used in various applications for its efficiency and compliance with XML standards. However, when DTD (Document Type Definition) support is enabled, Woodstox becomes susceptible to Denial of Service (DoS) attacks, particularly when processing untrusted XML input.
Vulnerability Detail
The vulnerability identified as CVE-2022-40152 arises from the way Woodstox handles XML parsing with DTD support. If an attacker supplies malicious XML content, it can lead to a stack overflow, causing the parser to crash. This vulnerability can be exploited to launch Denial of Service attacks, making the application unresponsive. The severity of this vulnerability is reflected in its CVSS score of 7.5, indicating a high risk to systems utilizing the affected versions of Woodstox.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can disable DTD processing in your Woodstox configuration. This can be done by setting the following property in your XML parser setup:
System.setProperty("javax.xml.XMLConstants/property/accessExternalDTD", "all");
Conclusion
CVE-2022-40152 represents a significant vulnerability in the Woodstox XML parser, particularly for applications that enable DTD support. Users are strongly encouraged to update their Woodstox installations to the latest version to avoid potential Denial of Service attacks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in open-source software effectively.
See every vulnerability recorded for libwoodstox-java →
FAQ
CVE-2022-40152 is a vulnerability in the Woodstox XML parser that can lead to Denial of Service attacks due to improper handling of DTD support.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check if your application is affected by CVE-2022-40152.
Exploitation of this vulnerability can cause the Woodstox parser to crash, leading to application downtime and potential service disruptions.
Yes, a patch is available. Users should update to the latest version of Woodstox that addresses CVE-2022-40152.
If immediate updating is not possible, you should disable DTD support in your XML parser configuration to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for libwoodstox-java.
