REXML ReDoS Vulnerability in Ruby Packages: CVE-2024-49761
Summary
CVE-2024-49761: REXML is an XML toolkit for Ruby. Affects ruby-rexml across 3 version ranges.
< 3.3.9-r0
< ce59f2eb1aeb371fe1643414f06618dbe031979f
< f5c772fc7cbe9f5b58d962939fcb1c7e3fb1cfa6
Fixed in 3.3.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REXML is an XML toolkit for Ruby, widely used for parsing and manipulating XML data. It provides a simple and efficient way to handle XML documents, making it a popular choice among Ruby developers. However, prior to version 3.3.9, REXML contained a ReDoS (Regular Expression Denial of Service) vulnerability that could be exploited when parsing specially crafted XML documents with numerous digits in hex numeric character references.
Vulnerability Detail
The vulnerability arises from the way REXML processes hex numeric character references in XML. Specifically, when an XML document contains many digits between &# and x...; in a hex numeric character reference (&#x...;), it can lead to excessive backtracking in the regular expression engine, causing significant performance degradation or even denial of service. This issue affects Ruby versions prior to 3.3.9, with Ruby 3.1 being the only maintained version vulnerable to this flaw. If exploited, attackers could craft XML inputs that would consume excessive CPU resources, potentially leading to service outages.
How To Fix
Minimum fixed version
3.3.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ruby-rexmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing XML documents that contain hex numeric character references with excessive digits. If possible, validate and sanitize XML inputs before parsing them with REXML to mitigate the risk of exploitation.
Conclusion
CVE-2024-49761 highlights a critical ReDoS vulnerability in the REXML gem for Ruby, affecting versions prior to 3.3.9. It is crucial for developers using vulnerable Ruby versions to update their packages promptly to avoid potential denial of service attacks. Implementing input validation can also help mitigate risks.
See every vulnerability recorded for ruby-rexml →
FAQ
CVE-2024-49761 is a vulnerability in the REXML gem for Ruby that allows for a ReDoS attack through specially crafted XML documents.
Ruby versions prior to 3.3.9 are affected, with Ruby 3.1 being the only maintained version vulnerable to this issue.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If updating is not possible, consider implementing input validation and sanitization to mitigate the risk of exploitation.
Yes, the patch is included in REXML gem version 3.3.9 and later. It is recommended to update to this version or higher.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rexml.
