CVE-2024-39908: REXML DoS Vulnerabilities in Ruby XML Toolkit
Summary
CVE-2024-39908: REXML is an XML toolkit for Ruby. Affects ruby-rexml across 2 version ranges.
< 3.3.9-r0
< 20017eea807e8fa386aa5c79ae779004d8b366dd
Fixed in 3.3.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REXML is an XML toolkit for Ruby, widely used for parsing and manipulating XML data. It provides a simple and efficient way to handle XML documents, making it a popular choice among Ruby developers. However, certain versions of the REXML gem are vulnerable to Denial of Service (DoS) attacks when parsing XML documents containing specific characters, which can lead to performance degradation or application crashes.
Vulnerability Detail
The REXML gem before version 3.3.1 contains vulnerabilities that can be exploited when parsing untrusted XML documents. Attackers can craft XML inputs with specific characters such as '<', '0', and '%>' that trigger excessive resource consumption during parsing. This can lead to Denial of Service (DoS) conditions, affecting the availability of applications relying on REXML for XML processing. The vulnerabilities are particularly concerning for applications that handle untrusted XML data, as they may be susceptible to malicious inputs.
How To Fix
Minimum fixed version
3.3.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ruby-rexmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users are advised to avoid parsing untrusted XML strings. Implementing strict validation and sanitization of XML inputs before processing can help mitigate the risk of exploitation.
Conclusion
The REXML gem has known vulnerabilities that can lead to Denial of Service attacks when parsing untrusted XML data. Users are strongly encouraged to upgrade to version 3.3.2 or later to mitigate these risks. For those unable to upgrade, avoiding the parsing of untrusted XML inputs is recommended. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ruby-rexml →
FAQ
CVE-2024-39908 is a vulnerability identifier for a Denial of Service (DoS) vulnerability found in the REXML gem used in Ruby applications.
REXML versions prior to 3.3.1 are affected by this vulnerability.
The vulnerability can lead to Denial of Service (DoS) conditions, causing applications to become unresponsive or crash when processing malicious XML inputs.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, Vulert can alert you to any vulnerabilities, including CVE-2024-39908.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rexml.
