Junglewise Threat Intelligence

CVE-2019-18197: Nokogiri Use After Free in libxslt dependency

CVE-2019-18197 · Severity: high · CVSS 7.5 · Published 2022-05-24

Technologies: nokogiri (RubyGems). Vendors: RubyGems.

Executive brief

Nokogiri, a popular Ruby library used for parsing and manipulating XML and HTML documents, was found to be using a vulnerable version of the libxslt library. This flaw could allow an attacker to cause a service crash, disclose sensitive information from memory, or potentially execute unauthorized code when the application processes a specially crafted document. Organizations using Nokogiri should update to version 1.10.5 or later to ensure they are using a patched version of the underlying processing engine.

Technical details

Nokogiri versions prior to 1.10.5 bundle libxslt 1.1.33, which contains a vulnerability in the `xsltCopyText` function within `transform.c`. The issue stems from a pointer variable not being properly reset under specific conditions, leading to a use-after-free or use of an uninitialized resource (CWE-416, CWE-908). An attacker can exploit this by providing a malicious XSLT stylesheet or XML document that triggers specific memory reuse patterns. Successful exploitation can result in a failed bounds check, allowing for out-of-bounds writes or the disclosure of uninitialized memory contents. The vulnerability is addressed in Nokogiri 1.10.5 by upgrading the bundled libxslt to version 1.1.34.

Affected products

  • Nokogiri Nokogiri < 1.10.5

Timeline

  • 2019-10-18: disclosed: NVD publication date
  • 2022-05-24: advisory: GitHub Advisory published

References

Related threats