CVE-2020-25614: Denial of service in github.com/antchfx/xmlquery
Summary
CVE-2020-25614: Denial of service in github.com/antchfx/xmlquery. Affects github.com/antchfx/xmlquery versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Also tracked for
- golang-github-antchfx-xmlquery · Debian:11
The same CVE-2020-25614 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/antchfx/xmlquery is a Go library that provides a simple and efficient way to parse and query XML documents. It is widely used in Go applications for XML processing tasks. However, a vulnerability has been discovered in the package that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in github.com/antchfx/xmlquery, identified as CVE-2020-25614, arises from the LoadURL function not properly checking the Content-Type of loaded resources. This can result in a panic due to a nil pointer dereference if the loaded resource is not XML. An attacker can exploit this by supplying malicious URLs, causing the application to crash and become unresponsive. This vulnerability poses a significant risk as it can be used as a vector for denial of service attacks.
How To Fix
Minimum fixed version
1.3.1
This is the first release that contains the fix.
go get github.com/antchfx/xmlquery@v1.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement their own validation of the Content-Type before passing URLs to the LoadURL function. This can be done by using the net/http package to make a HEAD request to the URL and checking the Content-Type header. If the Content-Type is not XML, the URL should not be passed to the LoadURL function. Here is an example of how this can be done in Go:
import (
"net/http"
"strings"
)
func validateURL(url string) bool {
resp, err := http.Head(url)
if err != nil {
return false
}
contentType := resp.Header.Get("Content-Type")
return strings.Contains(contentType, "xml")
}
By implementing this workaround, developers can mitigate the risk of the vulnerability until they are able to update to the fixed version of the package.
Conclusion
The vulnerability identified as CVE-2020-25614 in the github.com/antchfx/xmlquery package can lead to a denial of service attack. It is crucial for developers to update their applications to use version 1.3.1 or later of the package, which includes a fix for the vulnerability. In the meantime, a temporary workaround can be implemented to validate the Content-Type of URLs before passing them to the LoadURL function. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/antchfx/xmlquery →
FAQ
This vulnerability can be used by attackers to launch denial of service attacks against applications that use the github.com/antchfx/xmlquery package. By supplying malicious URLs, an attacker can cause the application to crash and become unresponsive, leading to service disruption.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply enter your Gopkg.lock file and the playground will analyze it for any open-source vulnerabilities, including CVE-2020-25614.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly update the affected package to mitigate the risk of potential attacks.
Yes, a fix for this vulnerability is available in version 1.3.1 of the github.com/antchfx/xmlquery package. It is recommended to update to this version or later to ensure the vulnerability is addressed.
Yes, a temporary workaround is available by implementing custom validation of the Content-Type before passing URLs to the LoadURL function. This can help mitigate the risk of the vulnerability until the package can be updated.
