Executive brief
fast-xml-parser is a JavaScript library used to parse and process XML documents in web applications. An attacker can craft a malicious XML document with specially crafted entity names that cause the parser's regex engine to enter an infinite or extremely slow loop, leading to a denial of service that freezes or crashes the application.
Technical details
This vulnerability is a ReDoS (Regular Expression Denial of Service) attack via unescaped entity names in DOCTYPE declarations. The library unsanitized entity names to construct a regex pattern used for entity replacement in the XML body, allowing attackers to inject special regex metacharacters. By creating an entity with a name that produces a pathologically slow regex (e.g., catastrophic backtracking), an attacker can cause the parser to hang indefinitely during the entity replacement phase. This occurs when DOCTYPE entity processing is enabled (default behavior). The vulnerability affects versions 4.1.3 through 4.2.3 and is fixed in v4.2.4; users can mitigate by disabling entity processing with the processEntities: false option.
Affected products
- NaturalIntelligence fast-xml-parser 4.1.3 to 4.2.3
Timeline
- 2023-06-06: disclosed
- 2023-06-06: patched: version 4.2.4