Is CVE-2023-34104 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-34104 being exploited in the wild.

How severe is CVE-2023-34104?

Low severity, with a CVSS score of 3.1, published 6 June 2023.

Which products and versions are affected?

fast-xml-parser (npm) SEMVER:introduced=4.1.3,fixed=4.2.4.

Is there a fix for CVE-2023-34104?

Yes. fast-xml-parser (npm): upgrade to 4.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-34104 attacked?

It is attacked over the network.

Am I affected by CVE-2023-34104?

Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-34104: fast-xml-parser regex injection via DOCTYPE entities

CVE-2023-34104 · Severity: low · CVSS 3.1 · Published 2023-06-06

fast-xml-parser is a JavaScript library used to parse and process XML documents in web applications. An attacker can craft a malicious XML document with specially crafted entity names that cause the parser's regex engine to enter an infinite or extremely slow loop, leading to a denial of service that freezes or crashes the application.

Technologies: fast-xml-parser (npm). Vendors: npm.

Quick answers

Is CVE-2023-34104 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-34104 being exploited in the wild.
How severe is CVE-2023-34104?: Low severity, with a CVSS score of 3.1, published 6 June 2023.
Which products and versions are affected?: fast-xml-parser (npm) SEMVER:introduced=4.1.3,fixed=4.2.4.
Is there a fix for CVE-2023-34104?: Yes. fast-xml-parser (npm): upgrade to 4.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-34104 attacked?: It is attacked over the network.
Am I affected by CVE-2023-34104?: Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-xml-parser (npm): upgrade to 4.2.4 or later
```
npm install fast-xml-parser@4.2.4
```

Technical details

This vulnerability is a ReDoS (Regular Expression Denial of Service) attack via unescaped entity names in DOCTYPE declarations. The library unsanitized entity names to construct a regex pattern used for entity replacement in the XML body, allowing attackers to inject special regex metacharacters. By creating an entity with a name that produces a pathologically slow regex (e.g., catastrophic backtracking), an attacker can cause the parser to hang indefinitely during the entity replacement phase. This occurs when DOCTYPE entity processing is enabled (default behavior). The vulnerability affects versions 4.1.3 through 4.2.3 and is fixed in v4.2.4; users can mitigate by disabling entity processing with the processEntities: false option.

Affected products

NaturalIntelligence fast-xml-parser 4.1.3 to 4.2.3

Identifiers

CVE-2023-34104
GHSA-6w63-h3fj-q4vw

Timeline

2023-06-06: disclosed
2023-06-06: patched: version 4.2.4

References

https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.